How SPF, DKIM, and DMARC work together

SPF, DKIM, and DMARC are related but different email-authentication mechanisms. Reviewing all three together helps avoid fixing one DNS record while leaving the broader policy unclear.

Use the Email Security Check

What SPF does

SPF publishes which mail systems may send for a domain. Receivers can use that policy as one signal when evaluating a message.

The policy needs an accurate sender inventory. A record that omits a legitimate platform can affect valid mail, while a broad policy can reduce the value of the signal.

What DKIM does

DKIM uses a signature added by a sending system and a public key record in DNS. The selector identifies which public record to use for a particular signer.

A DKIM record should be checked for the selector a provider actually uses. A record for a different selector does not prove that the relevant sender is configured correctly.

What DMARC adds

DMARC publishes a policy for messages that fail DMARC checks and brings SPF and DKIM into an alignment-focused framework. Its p=none, p=quarantine, and p=reject policies reflect different enforcement stages.

A DMARC record with p=none is useful for monitoring but is not the same as quarantine or reject enforcement.

Identify all legitimate sending services.
Check for one valid SPF policy and review its senders.
Check the DKIM selector used by each provider.
Check whether DMARC is present and which policy it publishes.
Make controlled DNS changes, then recheck the public signals.

Use the right check for the question

CloudSpex Email Security Check provides a public summary of MX, SPF, and DMARC. The dedicated SPF, DKIM, and DMARC tools focus on their specific public signals.

These tools are read-only and intentionally avoid exposing raw DNS records. They help prioritize a review; provider documentation remains the authority for changing a configuration.

Frequently asked questions

Do I need SPF, DKIM, and DMARC?

They serve different roles and are commonly reviewed together. The appropriate configuration depends on your legitimate senders and domain policy.

Can DMARC work without SPF or DKIM?

DMARC relies on authentication and alignment signals, so review SPF and DKIM before treating a DMARC policy as complete.

Does CloudSpex send test email?

No. The public tools read public-facing configuration signals and do not send email or change DNS.

Use public checks as a starting point

CloudSpex reads limited public-facing signals. It does not change DNS, website, certificate, or email settings. Confirm the responsible provider and test relevant changes before applying a remediation.