FREE LEARNING RESOURCE
Email authentication, explained plainly.
SPF, DKIM, DMARC and MX records work together, but each answers a different question. Understanding their limits is just as important as finding them.
SPF
Sender Policy FrameworkA DNS TXT record that identifies systems permitted to send mail for a domain. A published record still needs review for syntax, lookup limits and whether it matches the organization's actual senders.
DKIM
DomainKeys Identified MailA message-signing system. Public keys are published in DNS under selectors chosen by the mail provider. A basic domain-root lookup cannot discover every selector or prove that real messages are signed correctly.
DMARC
Domain-based Message Authentication, Reporting and ConformanceA policy that tells receiving systems how to handle messages that fail aligned SPF or DKIM checks, with optional reporting. Moving to enforcement should follow careful sender inventory and report review.
MX
Mail ExchangeDNS records that identify mail servers for inbound email. Their presence does not prove that a mailbox works or that outbound email is authenticated.
Educational information only. DNS observations are not a complete email security assessment and should not be used as the sole basis for changing production mail settings.
Try the free DNS snapshot