SPF vs DKIM: Which Matters More for Email Deliverability

SPF and DKIM both authenticate email, but they do different things. SPF checks that the sending server is allowed to send for your domain. DKIM adds a digital signature to verify the message wasn’t altered in transit. Without DMARC, neither one fully controls deliverability. DMARC tells the receiving server what to do when SPF or DKIM fails. So which matters more? It depends on your delivery goals. Let’s break it down.

How SPF Works for Deliverability

SPF (Sender Policy Framework) lists IP addresses authorized to send mail for your domain. When a receiving server gets a message, it looks up your SPF record. If the sending IP is on the list, SPF passes. If not, SPF fails.

A failed SPF doesn’t automatically block delivery. The receiving server may still accept the message, but it’s more likely to land in spam. SPF alone is weak because it can break when email forwarding changes the envelope sender. For example, if a forwarder rewrites the return-path, the original SPF check fails.

To avoid false failures, you need to include all legitimate senders in your SPF record. Many third-party services have their own SPF include mechanism. For a full guide on setting them up without breaking delivery, see How to Set Up SPF Records Without Breaking Your Email.

One practical tip: audit your SPF record regularly. When you add a new email service, add its include statement immediately. Otherwise, legitimate mail from that service may fail SPF and hurt your reputation. Also check for IPs that no longer send mail — remove them to keep the record lean and reduce DNS lookup count.

How DKIM Works for Deliverability

DKIM (DomainKeys Identified Mail) uses a public-private key pair. The sending server signs the email with a private key. The receiving server fetches your public key from DNS and verifies the signature. If the signature matches, DKIM passes.

DKIM survives email forwarding because the signature stays intact. That makes it more reliable than SPF for forwarded messages. A failed DKIM indicates tampering or a misconfigured key. Like SPF, a DKIM failure alone doesn’t block delivery, but it lowers reputation.

You must generate a key pair for each mail stream and publish the public key as a DNS TXT record. Use a separate selector for each service to revoke keys without affecting others. Common mistake: using a 512-bit key. That’s too short and easy to crack. Use 2048-bit keys for security. Also, rotate keys periodically — every six months is a good practice. If a key is compromised, you can publish a new one with a different selector without disturbing other streams.

When setting up DKIM, test the signature with a tool like a DKIM validator. Many email services offer a test email feature that shows whether the signature validates. Run this test before sending to real recipients.

DMARC: The Policy That Makes Authentication Matter

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It tells receivers what to do when authentication fails. Three policies exist:

Policy	Action on Failure	Effect on Deliverability
None (p=none)	Take no action, just report	Messages still delivered, but risk flagged
Quarantine (p=quarantine)	Send to spam folder	Likely not seen by recipient
Reject (p=reject)	Block delivery entirely	Message never reaches inbox

Without DMARC, SPF and DKIM are advisory. With DMARC policy set to reject, failures become real blocking events. So DMARC is the enforcer. You need both SPF and DKIM passing for DMARC alignment to succeed.

A common pitfall: setting DMARC to reject too early. Start with p=none and monitor the aggregate reports for a few weeks. Look for any legitimate mail that fails authentication. Fix those sources before tightening the policy. Otherwise, you may block your own marketing emails or transactional messages. Also, don’t forget to set the correct subdomain policy if you use subdomains for email. You can either let subdomains inherit the parent policy or set a separate one.

Comparing SPF and DKIM Side by Side

Here’s a quick comparison:

• What they check: SPF checks the sending IP; DKIM checks message integrity.
• Forwarding: SPF often breaks; DKIM survives.
• Setup complexity: SPF is one TXT record; DKIM requires key generation.
• Failure handling: Without DMARC, both are soft failures.
• Which to prioritize: Both, but DKIM is more resilient for complex architectures.

For a deeper dive into all aspects of email authentication, read Email Deliverability: A Beginner’s Guide for B2B Marketers.

Another difference: SPF has a hard limit of 10 DNS lookups. Each include: statement counts as one lookup. If you exceed 10, the receiving server may ignore the entire record, causing all mail to fail SPF. To reduce lookups, consolidate multiple services under one include if possible, or use IP ranges instead of individual IPs. DKIM has no such lookup limit, but each selector adds one query — still manageable.

Which One Matters More for Deliverability?

If you must pick one, DKIM matters more because it survives forwarding and proves the message hasn’t been altered. But a single authentication method is not enough. Many mailbox providers require both SPF and DKIM to pass for high deliverability. Gmail and Yahoo, for example, enforce DMARC alignment for bulk senders.

The real answer: DMARC matters most because it turns authentication into action. Without DMARC, SPF or DKIM failures have no consequence beyond reputation scoring. With DMARC reject, a failure means the message doesn’t get delivered at all. So the hierarchy is: DMARC > DKIM > SPF, but you need all three to pass.

Trade-off: DMARC reject can break legitimate forwarded messages if the forwarding service doesn’t implement ARC (Authenticated Received Chain). In that case, you may need to start with quarantine and monitor before moving to reject. Some mailbox providers also treat DMARC failures differently — for example, they may reject based on SPF failure alone even without DMARC. But relying on that is risky. A consistent DMARC policy gives you control.

How to Set Up SPF, DKIM, and DMARC Step by Step

1. Create an SPF record. List all servers that send mail from your domain. Use include: statements for third-party services. End with -all (hard fail). Test the record with an SPF validator to ensure it doesn’t exceed 10 lookups.
2. Generate DKIM keys. Create a public-private key pair for each mail stream. Publish the public key as a TXT record with a unique selector. For example, use “s1” for your marketing platform, “s2” for transactional emails. Use 2048-bit keys. Verify that the signature works by sending a test email and checking headers.
3. Publish a DMARC record. Start with p=none and monitor reports. Include a rua email address to receive aggregate reports. Once you confirm all mail is authenticated, switch to p=quarantine, then p=reject. Set a policy of p=reject for the root domain and optionally a separate policy for subdomains if needed.
4. Monitor failures. Use DMARC aggregate reports to find unauthenticated sources. Update SPF and DKIM as needed. Also check forensic reports (ruf) for detailed failure info, but beware they may contain sensitive data.

For a complete walkthrough of auditing your current setup, check Email Deliverability Audit: A Step-by-Step Guide for Marketers.

Common Mistakes and Trade-offs

One common mistake is using ~all (soft fail) instead of -all. Soft fails allow spoofed mail to pass through. Another is having too many DNS lookups in SPF — the limit is 10. Exceeding it causes the record to be ignored. For DKIM, a short key length (like 512-bit) is insecure; use 2048-bit. Also, never use the same selector for different services; if one is compromised, all are.

A trade-off: DMARC reject can break legitimate forwarded messages if the forwarding service doesn’t implement ARC (Authenticated Received Chain). In that case, you may need to start with quarantine and monitor before moving to reject. Also, some email services don’t align DKIM properly — they sign with their own domain instead of yours. That causes DKIM alignment failure even if the signature is valid. Check with your email provider to ensure they use your domain in the d= field of the DKIM signature.

Another mistake: ignoring DMARC reports. Aggregate reports show you which IPs are sending mail for your domain and whether they authenticate. If you don’t act on them, you may never notice a spoofing attempt or a misconfigured service. Schedule a regular review — weekly at first, then monthly once everything is stable. Use a DMARC report parser to extract actionable data quickly.

How to Diagnose Authentication Problems Quickly

When email goes to spam, check the authentication headers in the original message. Look for “spf=pass” or “spf=fail”, “dkim=pass” or “dkim=fail”, and “dmarc=pass” or “dmarc=fail”. If any fails, trace the cause:

• SPF fail: The sending IP isn’t listed in your SPF record. Add it or include the service’s SPF record.
• DKIM fail: The signature may be missing, malformed, or the public key is wrong. Regenerate keys or check DNS propagation.
• DMARC fail: Both SPF and DKIM may have passed, but alignment failed. Alignment means the domain in SPF/DKIM must match the domain in the From header. If you send from a subdomain or a different domain, DMARC may fail. Use a consistent domain across all headers.

For forwarded email, SPF often fails because the forwarder changes the envelope sender. DKIM survives, so focus on ensuring DKIM passes for forwarded messages. If you need DMARC reject but forward mail, implement ARC on your forwarding server or use a service that supports it.

Conclusion

Neither SPF nor DKIM alone ensures deliverability. They work together under DMARC. Start with both records, then set DMARC to reject. Monitor and adjust based on reports. That’s the only reliable path to high inbox placement.

Frequently asked questions

Can I have deliverability with only SPF and no DKIM?

Technically yes, but it’s risky. Without DKIM, your messages lack integrity verification. Many mailbox providers treat missing DKIM as a negative signal. DMARC alignment requires either SPF or DKIM to pass, so DKIM gives you a second chance if SPF fails.

Does DMARC work without both SPF and DKIM?

DMARC requires at least one of SPF or DKIM to pass and be aligned. If neither passes, DMARC will enforce its policy. So you need at least one working authentication method. Best practice is to have both.

Why would SPF fail for forwarded emails?

When an email is forwarded, the envelope sender (return-path) may change. The forwarder becomes the new sender. The original SPF record only authorizes the original sender’s IP, not the forwarder’s. So SPF fails. DKIM survives because the signature is in the header.

How do I know if my SPF record is set correctly?

Use online SPF lookup tools or check your DNS records. Ensure the record ends with -all for hard fail. Count DNS lookups; you must have 10 or fewer. Also verify that all your sending IPs or include statements are present.

What is the recommended key length for DKIM?

Use 2048-bit keys. Some providers support 1024-bit, but 2048 is more secure and widely accepted. Shorter keys (512-bit) are considered weak and may be rejected by some receivers.