Home › Study Guides › SPF vs DKIM vs DMARC
SPF vs DKIM vs DMARC (and BIMI): What Each One Does
SPF lists which servers may send mail for a domain. DKIM signs each message so the receiver can verify it wasn't changed and which domain signed it. DMARC checks that the visible From domain lines up with a passing SPF or DKIM result, tells receivers what to do when it doesn't (none, quarantine or reject), and sends you reports. BIMI shows your brand logo in supporting inboxes, but only once DMARC is enforced.
SPF vs DKIM vs DMARC vs BIMI in one table
| SPF | DKIM | DMARC | BIMI | |
|---|---|---|---|---|
| Answers | Is this server allowed to send for the domain? | Was the message changed, and which domain signed it? | Does the From domain align with a pass, and what if it doesn't? | Which logo should the inbox show? |
| Checks | Sending IP against the envelope sender's (Return-Path) domain | Cryptographic signature in the message header (d= domain) | Alignment of the visible From domain with SPF or DKIM | Nothing; it relies on DMARC being enforced |
| DNS record | TXT on the domain: v=spf1 … | TXT at selector._domainkey.domain: v=DKIM1; p=… | TXT at _dmarc.domain: v=DMARC1; p=… | TXT at default._bimi.domain: v=BIMI1; l=… |
| Stops on its own? | No. Spoofing the visible From address still passes | No. An attacker can sign with their own domain | Yes, for exact-domain spoofing, with p=quarantine or p=reject | No. It's branding, not protection |
| Survives forwarding? | Usually breaks (new sending IP) | Usually survives if the body isn't modified | Passes if DKIM still aligns | Follows DMARC |
| Common mistake | Two SPF records, or more than 10 DNS lookups | Third-party senders not signing with your domain | Leaving p=none forever | Publishing it before DMARC is at quarantine/reject |
How they work together when a message arrives
- SPF: the receiver looks up the SPF record for the envelope sender's domain and checks whether the connecting IP is allowed.
- DKIM: it fetches the public key from
selector._domainkey.d-domainand verifies the signature over the headers and body. - DMARC alignment: it compares the domain in the visible
From:header with the SPF domain and the DKIMd=domain. DMARC passes if at least one of them passed and aligns. - DMARC policy: if DMARC fails, the receiver applies
p=: deliver anyway (none), send to spam (quarantine) or refuse (reject), and includes the result in the aggregate report sent torua=. - BIMI: if DMARC passes at an enforced policy and the inbox supports BIMI, it shows the logo from
l=(some inboxes, such as Gmail and Apple Mail, also require a mark certificate, VMC or CMC, ina=).
Why SPF and DKIM alone don't stop spoofing: SPF validates the hidden envelope sender, and DKIM validates whichever domain signed. Neither requires that domain to match the From address people see. DMARC alignment is what ties them to the visible sender.
Record reader: paste a record, get plain English
Paste an SPF, DKIM, DMARC or BIMI TXT record. It is read in your browser only; nothing is looked up or sent anywhere.
The safe rollout order
- List every service that sends mail as your domain (mail server, marketing platform, ticketing, invoicing).
- Publish one SPF record covering them, ending in
~allwhile you test and-allonce you're confident. Stay under 10 DNS lookups. - Turn on DKIM signing with your own domain for each service.
- Publish DMARC at
p=nonewith arua=address and read the aggregate reports for a few weeks. - Fix any legitimate sender that fails alignment, then move to
p=quarantineand finallyp=reject. - Only then publish BIMI, with an SVG Tiny PS logo and, for inboxes that require it, a verified or common mark certificate (VMC or CMC).
Security+ check: which one is it?
SY0-801 objective 4.1 lists DMARC, SPF, DKIM and BIMI. The exam usually describes a need and asks which control fits.
FAQ
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for a domain. DKIM adds a cryptographic signature so receivers can verify a message wasn't changed and which domain signed it. DMARC requires the visible From domain to align with a passing SPF or DKIM result, tells receivers what to do when it doesn't, and sends reports.
Do I need all three?
Yes. SPF and DKIM each authenticate part of a message, but neither ties the result to the From address people see. DMARC adds that link and the enforcement policy. Major mailbox providers now expect bulk senders to have SPF, DKIM and DMARC in place.
Why does DMARC fail when SPF passes?
Because of alignment. SPF checks the envelope sender (Return-Path). If that domain doesn't match the domain in the visible From header, SPF can pass while DMARC still fails, unless DKIM passes with an aligned domain.
What does BIMI need?
BIMI needs DMARC at an enforced policy (quarantine or reject) applied to all mail, a logo in SVG Tiny PS format served over HTTPS, and for some inboxes such as Gmail a verified or common mark certificate.
Is SPF, DKIM and DMARC on the Security+ exam?
Yes. CompTIA Security+ SY0-801 objective 4.1 lists DMARC, SPF, DKIM and BIMI under email security. Expect scenario questions asking which one fits a stated need.