# SPF, DKIM and DMARC explained

> Understand what SPF, DKIM and DMARC check, how identifier alignment works, and what the none, quarantine and reject DMARC policies mean.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Updated: 2026-11-06.

Free to use. No account required.

## SPF authorizes the sending server

SPF checks whether the sending IP is allowed to send for the envelope sender domain, usually shown in Return-Path. For DMARC, that domain also needs to align with the visible From domain. SPF can pass while DMARC still fails if the identities do not align.

## DKIM signs the message

DKIM adds a cryptographic signature to the message. A receiving server verifies it using the public key published in DNS. DMARC can use a passing DKIM signature when its signing domain aligns with the visible From domain. DKIM can survive forwarding when the signed message content is preserved.

## DMARC ties authentication to the From domain

DMARC passes when at least one of SPF or DKIM passes and aligns with the visible From domain. Relaxed alignment allows related subdomains of the same organizational domain; strict alignment requires an exact domain match.

## Understand the DMARC policy

A policy of none requests monitoring without enforcement. Quarantine asks receivers to treat failing messages as suspicious, and reject asks them to reject failing messages. Receivers apply their own local policies, so authentication alone does not guarantee delivery or inbox placement.

## Related pages

- [CheckDMARC — Test SPF, DKIM and DMARC](https://checkdmarc.mx/index.md)
- [How it works](https://checkdmarc.mx/how-it-works/index.md)
- [Sample email authentication report](https://checkdmarc.mx/sample-result/index.md)
- [SPF, DKIM and DMARC explained](https://checkdmarc.mx/spf-dkim-dmarc/index.md)

- [Knowledge base](https://checkdmarc.mx/learn/index.md)
- [Blog](https://checkdmarc.mx/blog/index.md)

Web page: https://checkdmarc.mx/spf-dkim-dmarc