SPF and DKIM can both authenticate a message, but they validate different identities. DMARC then compares those identities with the domain visible to the recipient in the From header.
1. SPF authenticates the return path
SPF checks whether the connecting IP is authorized for the envelope-from or return-path domain. SPF can pass while DMARC fails when that authenticated domain is unrelated to the visible From domain.
2. DKIM authenticates a signing domain
DKIM verifies that selected message content was signed by the domain in the d= tag and was not altered in a way that breaks the signature. DKIM alignment compares that signing domain with the visible From domain.
3. DMARC needs one aligned pass
DMARC passes when SPF passes and aligns, or DKIM passes and aligns. Using both aligned paths is more resilient because forwarding can break SPF and message modification can break DKIM.
4. Test the received message
Inspect Authentication-Results, Return-Path, DKIM-Signature and From on the copy received by Gmail or another mailbox. DNS tools alone cannot prove that the production application used the intended identity.
Implementation checklist
- Return-Path domain identified
- DKIM d= domain identified
- Visible From domain identified
- At least one path passes and aligns
- Forwarding and third-party senders reviewed
Primary references
Share the sending domain, route, message purpose, expected volume and a recent received-message header.
Request technical review