What Are DKIM, SPF, and DMARC?
DKIM (DomainKeys Identified Mail), SPF (Sender Policy Framework), and DMARC (Domain-based Message Authentication, Reporting and Conformance) are three complementary email authentication protocols that work together to verify the legitimacy of email messages and protect against fraud.
SPF is the foundation layer. It allows domain owners to publish a list of authorised mail servers in their DNS records. When an email arrives, the receiving server checks if the sending server's IP address matches those listed in the SPF record. This prevents attackers from spoofing your domain by sending emails from unauthorised servers.
DKIM adds cryptographic verification. It attaches a digital signature to outgoing emails using public-key cryptography. The receiving server can verify this signature against the public key published in your DNS records, confirming the email genuinely came from your domain and hasn't been altered in transit.
DMARC is the policy layer that ties everything together. It specifies what receiving servers should do if SPF or DKIM checks fail – whether to accept, quarantine, or reject suspicious emails. Critically, DMARC also generates reports showing authentication results, giving you visibility into who's sending emails on behalf of your domain.
Why This Matters for UK Marketers
Email remains central to UK marketing strategies, particularly for campaigns targeting regulated sectors like financial services and healthcare. Proper authentication is non-negotiable: it protects your sender reputation, improves inbox placement rates, and demonstrates compliance with data protection standards.
Without these protocols, competitors or criminals can impersonate your domain, damaging customer trust and brand equity. Major ISPs (Gmail, Outlook, Yahoo) increasingly penalise unauthenticated mail, so implementation directly affects campaign performance.
When You'll Use These
Implement DKIM, SPF, and DMARC when:
- Launching email marketing campaigns
- Migrating to new email service providers
- Operating multiple sending domains
- Sending transactional emails (receipts, password resets)
- Complying with client security requirements
- Managing brand protection across team domains
Your ESP (email service provider) typically handles DKIM signing automatically, but you must publish SPF and DMARC records in your DNS. Start with SPF and DKIM in "report" mode, monitor results via DMARC reports, then gradually enforce stricter policies.