SPF, DKIM, and DMARC: What’s the Difference?

Three DNS-backed standards protect business email. They solve different jobs — and work best together when you host mail on MailShrine.

Deep dives: SPF · DKIM · DMARC.

Real-life example: Stack&Ship

Kemi thought “we added SPF, we’re done.” Phishing still used lookalike From headers. Adding DKIM + DMARC p=none closed the story buyers were asking about on security questionnaires.

How they stack

1. Sender transmits via MailShrine.
2. Receiver checks SPF for the connecting IP path.
3. Receiver verifies DKIM signature.
4. DMARC checks alignment and applies policy.

Missing any layer leaves a gap.

What you need

MailShrine domain + DNS access + 30 focused minutes.

Step 1: Publish MX first

Inbound must work (MX explained).

Step 2: One SPF record

Merge includes (SPF guide).

Step 3: DKIM selector TXT

Paste MailShrine’s key (DKIM).

Step 4: DMARC at p=none

Monitor, then tighten (DMARC).

Step 5: Verify as a set

MailShrine verification + header checks on a test message.

Checklist

• MX correctCompleted
• Single SPFCompleted
• DKIM passCompleted
• DMARC publishedCompleted
• Understand each roleCompleted

Common mistakes

1. Treating the three as synonyms.
2. Two SPF records.
3. DMARC reject before SPF/DKIM pass.
4. Ignoring marketing tools that also send as you.

Next steps

• Spam troubleshooting · Registrar verify · Setup

Citations & References

• Reference: Google: Email sender guidelines
• Reference: Cloudflare Learning Center: DNS records
• Reference: ICANN: What is DNS?

Written by Elena R., Email Authentication Specialist. Elena teaches authentication stacking without jargon overload.