Since 2024 the large mailbox providers require bulk senders to authenticate with SPF and DKIM and to publish a DMARC policy. Even for small senders, a failing record is the fastest route to the spam folder. The three mechanisms answer three different questions.

SPF: is this server allowed to send for the domain?

SPF is a DNS TXT record on your sending domain listing the servers that may send mail on its behalf. The receiving server looks at the envelope sender (the Return-Path, not the visible From) and checks whether the connecting IP is in that list. Typical failure causes: a new sending service was added without updating the record, the record exceeds the ten-lookup limit, or a forwarding step changed the connecting IP.

DKIM: was the message altered since it was signed?

DKIM adds a cryptographic signature to selected headers and the body. The public key sits in DNS under a selector. If the signature verifies, the receiver knows the message was signed by the domain in the signature and has not been modified. Failures usually come from a missing or rotated key, a mailing-list footer added after signing, or a sending tool signing with its own domain instead of yours.

DMARC: what should the receiver do, and does it match the From?

DMARC ties the two together. It asks whether at least one of SPF or DKIM passed and whether the domain that passed aligns with the domain in the visible From header. Then it tells the receiver what to do on failure: p=none (monitor), p=quarantine (spam) or p=reject. DMARC also sends you aggregate reports showing who is sending as your domain.

Alignment is where most "but SPF passes" conversations end. If your newsletter tool sends with its own Return-Path and signs with its own DKIM domain, SPF and DKIM both pass for the tool's domain, and DMARC still fails for yours.

Reading the verdicts in a test

When a message arrives, the receiving server writes its findings into an Authentication-Results header, for example:

Authentication-Results: mx.google.com;
  dkim=pass header.i=@example.com;
  spf=pass smtp.mailfrom=example.com;
  dmarc=pass (p=REJECT) header.from=example.com

Mailproof extracts those verdicts for every seed mailbox so you can see at a glance whether each provider accepted your authentication. A softfail, temperror or none deserves attention even when the message still reached the inbox: reputation can carry a message today and drop it tomorrow.

A checklist

  • One SPF record per domain, under ten DNS lookups, ending in -all or ~all.
  • DKIM keys of at least 2048 bits, rotated when staff or vendors change.
  • A DMARC record on the organisational domain, starting at p=none with reporting, moving to quarantine and reject once reports are clean.
  • Custom Return-Path and DKIM domains configured in every third-party tool so that everything aligns with your From domain.