Short answer: DKIM signs emails with a digital signature so recipients can verify the sender hasn’t been tampered with. DMARC tells receivers what to do if an email fails DKIM or SPF checks. You need both for full protection: DKIM proves authenticity, DMARC enforces policy.
Key takeaways
- DKIM uses a private-public key pair to sign emails.
- DMARC instructs receivers on handling authentication failures.
- DKIM alone doesn’t enforce policy; DMARC does.
- Both work with SPF for complete email authentication.
- DMARC requires either SPF or DKIM alignment to pass.
- Without DMARC, attackers can spoof your domain even if DKIM is set.
What you will find here
If you’re serious about email deliverability, you already know SPF isn’t enough. But many marketers confuse DKIM and DMARC — or think they can skip one. The truth is, DKIM and DMARC serve different purposes, and you need both to stop spoofing and keep your emails out of spam.
Let’s break down what each does, how they differ, and why they work best as a team.
What Is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email. That signature is created using a private key stored on your mail server. The receiving server looks up your public key in your DNS records to verify that the email wasn’t altered in transit and that it actually came from your domain.
Think of it like a tamper-proof seal. If the signature doesn’t match the public key, the email fails DKIM. That doesn’t automatically mean it’s rejected — but it’s a red flag.
What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells email receivers what to do when an email fails authentication: quarantine it, reject it, or let it through anyway. DMARC also sends reports back to you so you can see who’s sending email from your domain — including potential attackers.
DMARC mandates that at least one of SPF or DKIM passes, and that the domain in the “From” header aligns with the domain used in SPF or DKIM. That alignment requirement stops spoofers from using lookalike domains.
DKIM vs DMARC: Key Differences
The table below summarizes the main differences.
| Aspect | DKIM | DMARC |
|---|---|---|
| Primary purpose | Verify email integrity and sender authenticity | Enforce policy on failed authentication |
| What it adds to DNS | A TXT record with your public key | A TXT record with your policy (none, quarantine, reject) |
| Does it prevent spoofing alone? | No — attackers can still send unauthenticated emails | Yes, when combined with SPF or DKIM |
| Alignment check? | No | Yes — enforces domain alignment |
| Provides reporting? | No | Yes — aggregate and failure reports |
How DKIM Works Step by Step
1. Generate a Key Pair
Your email server creates a public and private key. The private key stays on your server.
2. Publish the Public Key in DNS
You add a TXT record with the public key. The record includes a selector (like “google” or “s1”) that tells receivers where to find the key.
3. Sign Outgoing Emails
Your server signs every outgoing email with the private key. The signature is added to the email headers.
4. Verify on Receipt
The receiving server fetches your public key from DNS and checks the signature. If it matches, DKIM passes.
How DMARC Works Step by Step
1. Set Up SPF and DKIM First
DMARC requires SPF or DKIM to function. Without them, DMARC has nothing to evaluate.
2. Publish a DMARC Policy
You add a TXT record with your policy. Example: v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com
3. Receivers Check Alignment
When an email arrives, the receiver checks SPF and DKIM. If either passes and the domain aligns, DMARC passes. If both fail, DMARC applies your policy.
4. Get Reports
You receive aggregate reports showing authentication results and any spoofing attempts.
Why You Need Both
DKIM alone can’t stop spoofing. An attacker can send email from a different domain without DKIM and it will reach the inbox if the receiver doesn’t check DKIM. DMARC forces receivers to check alignment and apply a policy.
Conversely, DMARC without DKIM is weak. SPF can fail on forwarded emails or mailing lists. DKIM survives forwarding because the signature stays intact. With DMARC requiring DKIM alignment, you get a robust solution.
Many marketers set up DKIM and call it done. Then they wonder why their emails still land in spam. The missing piece is DMARC. Without a policy, receivers treat unauthenticated email as suspicious. With DMARC set to quarantine or reject, you force failures to stay away from the inbox.
Common Mistakes and How to Avoid Them
One common error is setting DMARC to p=reject before all legitimate senders are authenticated. That can block your own emails. Start with p=none to monitor, then switch to p=quarantine, then p=reject once confident.
Another mistake is using different domains in the “From” header and the envelope sender. That breaks alignment and causes DMARC failures. Make sure your email platform uses the same domain in both places.
If you’re troubleshooting DMARC failures, check your report data. A common pattern: SPF passes but alignment fails because the envelope sender domain differs from the From domain. Fix it by aligning domains or adjusting your sending setup.
Don’t forget to verify your DKIM selector. Many providers default to a generic selector like “default” — if you change providers without updating the DNS record, DKIM will break. Keep a record of all selectors in use and audit them regularly.
How to Interpret DMARC Reports
DMARC reports come in two flavors: aggregate (RUA) and forensic (RUF). Aggregate reports show volume and authentication results per source IP. Forensic reports contain the actual failed email headers — useful for identifying specific spoofing attempts.
To read aggregate reports, look at the row element: source_ip, count, disposition. Check the policy_evaluated section to see if SPF or DKIM passed and whether alignment was satisfied. If you see a high count from an unknown IP, investigate that sender.
Automate report parsing with a service or script — manual review doesn’t scale past a few thousand emails per day. Many DMARC reporting tools give you a dashboard that highlights failures and spoofing attempts.
Choosing Between DKIM and DMARC for Your Automation Workflow
In B2B automation workflows, you send transactional emails, newsletters, and sales sequences. Each type may use a different sending subdomain. For example, mail.yourdomain.com for newsletters and transact.yourdomain.com for transactional emails. DMARC can apply separate policies per subdomain, but the simplest approach is to have one sending domain and align everything under it.
For transactional emails, DKIM is critical because SPF can break on forwarding. If a recipient forwards your email to a colleague, SPF fails on the forward, but DKIM survives. With DMARC requiring DKIM alignment, you ensure forwarded emails still pass authentication.
For marketing sequences, you often send via third-party platforms like Salesforce or HubSpot. These platforms handle DKIM signing for you if you set it up. Confirm that they use your domain (not theirs) in the From header, or configure subdomains that give them their own DKIM keys. That keeps alignment intact.
One trade-off: DMARC’s reporting adds complexity. If you run many subdomains, each generates separate reports. Consolidate by using a single reporting address (rua) for all subdomains, then filter by source. Start with a monitoring policy and iterate.
Final Practical Steps
Start with DKIM. Generate a key pair and publish the public key in DNS. Then deploy DMARC with a monitoring policy. Analyze the reports for unauthorized senders. Once you’ve whitelisted all legitimate sources, tighten your DMARC policy to reject.
Both protocols are free to set up — they only require DNS changes. The time invested pays off in higher deliverability and fewer spoofing headaches.
Frequently asked questions
Can DMARC work without DKIM?
Yes, DMARC can work with just SPF. But SPF fails on forwarded emails and mailing lists. DKIM is more reliable because the signature survives forwarding. For best results, use both SPF and DKIM, then use DMARC to require either one to pass.
Does DKIM alone prevent email spoofing?
No. DKIM only verifies that a signed email came from your domain and wasn’t altered. Spoofers can still send unsigned emails from your domain. DMARC is needed to tell receivers to reject or quarantine emails that fail authentication.
What happens if DMARC policy is set to p=none?
With p=none, DMARC does not enforce any action. Emails that fail authentication still get delivered. Use p=none only for monitoring. Once you understand your email flows, move to p=quarantine or p=reject.
How long does it take for DMARC to improve deliverability?
After setting up DMARC, you’ll start receiving reports within hours. But improving deliverability takes time. Monitor reports for a few weeks, identify all legitimate senders, then tighten your policy. The real improvement comes when you move from p=none to p=reject.
Do I need SPF, DKIM, and DMARC for all domains?
Yes, every domain you send email from should have all three. Even if you only send marketing emails, spoofers can use your domain to scam recipients. Full authentication protects your reputation and stops spoofed emails from damaging your deliverability.