What is the difference between SPF, DKIM and DMARC?

SPF lists authorized sending servers. DKIM signs messages cryptographically. DMARC requires one of them to pass with domain alignment, sets the failure policy, and collects reports. You need all three.

Is p=none enough for deliverability?

Increasingly no. Google and Yahoo's bulk-sender requirements expect enforcement; p=none is a monitoring phase, not a destination.

Will p=reject break my legitimate email?

Only if a sender fails both SPF and DKIM alignment which the rua monitoring phase exists to catch. Fix stragglers first, then enforce.

DMARC Guide

By Abdul Sami, GTM Engineer · 7 min read · Last updated 2026-08-31

DMARC tells receivers what to do when email claiming to be from your domain fails SPF and DKIM alignment: nothing (p=none), spam-folder it (p=quarantine), or reject it (p=reject). Roll out safely: publish p=none with rua reporting, watch reports for 2–4 weeks, then enforce.

What DMARC actually checks

DMARC requires SPF or DKIM to pass AND align the domain in the visible From: header must match the domain those checks authenticated. This alignment requirement is what stops direct spoofing of your From address.

The policy ladder

Policy	Effect	Phase
p=none	Monitor only; failures delivered	Weeks 1–4: data collection
p=quarantine	Failures go to spam	Enforcement begins
p=reject	Failures blocked outright	End state maximum protection

rua reporting: your visibility layer

The rua=mailto: tag makes receivers send you daily aggregate XML reports of everything sending as your domain legitimate tools you forgot about and spoofing attempts alike. Without it, enforcing blind risks blocking your own transactional mail.

Don't forget subdomains

The sp= tag sets the subdomain policy. Attackers pivot to unprotected subdomains; set sp=reject once the root is enforced, or publish explicit records per sending subdomain.

FAQ

What is the difference between SPF, DKIM and DMARC?: SPF lists authorized sending servers. DKIM signs messages cryptographically. DMARC requires one of them to pass with domain alignment, sets the failure policy, and collects reports. You need all three.
Is p=none enough for deliverability?: Increasingly no. Google and Yahoo's bulk-sender requirements expect enforcement; p=none is a monitoring phase, not a destination.
Will p=reject break my legitimate email?: Only if a sender fails both SPF and DKIM alignment which the rua monitoring phase exists to catch. Fix stragglers first, then enforce.

Abdul Sami

GTM Engineer, DFY GTM Systems

7+ years building outbound systems for B2B companies across the US, UK, Australia, and DACH. Specializes in Clay workflows, cold email infrastructure, intent-based lead sourcing, and deliverability.

DMARC Guide

What DMARC actually checks

The policy ladder

rua reporting: your visibility layer

Don't forget subdomains

FAQ

Free tools for this

Related guides

Rather have it built for you?