SPF vs DKIM vs DMARC
SPF, DKIM, and DMARC answer related but different questions. None of them, by itself or together, guarantees that an email's request is trustworthy.
SPF: Was this server allowed?
SPF compares the sending server with the policy for the envelope-sender domain. It can be affected by forwarding and does not necessarily authenticate the visible From address.
DKIM: Did this domain sign the message?
DKIM verifies a cryptographic signature and helps detect changes to signed content. The signing domain may differ from the visible sender.
DMARC: Does authentication align with From?
DMARC requires a passing SPF or DKIM result that aligns with the visible From domain. It also lets domain owners publish handling and reporting policies.
How to interpret them together
Three passes are positive technical evidence that the message was authorized for the domains involved. They do not confirm that the domain belongs to a claimed organization or that a request for money, credentials, or an account change is legitimate.
Failures deserve attention, especially in combination, but forwarding and misconfiguration can affect legitimate mail. Use the full header and independently verify sensitive requests.
Check a suspicious email
Paste the message or full header into the local Email Analyzer to review technical warning signs.
Check an Email