SPF, DKIM and DMARC explained
SPF and DKIM prove different parts of a message. DMARC decides whether either proof matches the visible From domain and what receivers should do when it does not.
SPF authorizes the sending server
SPF checks whether the sending IP is allowed to send for the envelope sender domain. For DMARC, that domain also needs to align with the visible From domain, otherwise SPF can pass while DMARC still fails.
DKIM signs the message
DKIM adds a cryptographic signature to the message headers. DMARC can use DKIM when the signing domain aligns with the visible From domain. This path is often the most reliable because it survives forwarding better than SPF.
DMARC ties authentication to the From domain
DMARC passes when SPF or DKIM passes and aligns with the visible From domain. The published policy tells receivers whether to monitor only, quarantine, or reject messages that fail.