DKIM, SPF and DMARC: how to tell a real email.
Anyone can type any address into the From line of an email. DKIM, SPF and DMARC are the three checks that tell receiving servers whether a message really comes from the domain it claims. This guide explains what each one checks, where each one fails, and which of them proves the sender when you verify a sign-up by email.
- What each of the three checks
- Why forwarding breaks SPF
- Which check proves the sender
Christian Schätzlein, Founder and developer of Sendity
4 min read
Which sender is proven?
Five incoming emails and what the checks say
-
anna@posteo.de DKIM d=posteo.de, SPF pass 08:12
Sender proven Signed by the domain in the From address. The normal case.
-
tim@gmail.com DKIM d=gmail.com, SPF fail 08:40
Sender proven Forwarded on the way, so SPF fails. The signature survived, the sender is proven.
-
info@firma.de No DKIM, SPF pass 09:05
Not proven The server may send for firma.de, but nothing ties the From address to it.
-
lea@uni.example DKIM d=lists.example 10:31
Not proven Sent via a mailing list that signs with its own domain.
-
chef@bank.example No DKIM, SPF fail 03:17
Not proven Spoofed From address from a random server.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
They answer different questions, and only together do they cover the From address.
SPF: may this server send?
The domain owner publishes in DNS which servers may send its mail. SPF checks the technical envelope sender, not the From address people see, and fails as soon as a message is forwarded through another server.
DKIM: is the message signed?
The sending server signs headers and body with a key whose public half sits in DNS. The signature names the signing domain and survives forwarding as long as nobody changes the message.
DMARC: does it match the From?
DMARC ties SPF or DKIM to the domain in the visible From address, called alignment, and tells receivers what to do if neither matches: nothing, spam folder or reject.
Where it breaks
Forwarding breaks SPF. Mailing lists that add a footer or change the subject break the DKIM signature. Many small company domains publish no DKIM at all.
Why it matters for sign-ups
If you verify a sign-up by an email the user sends, the From address is the claim. A DKIM signature aligned with that domain is what proves it, because it holds even after forwarding.
How Sendity checks a sent email.
A sign-up by email counts only if the sender is proven, not just the code.
Code in the message
The visitor sends the email that their mail app has prepared, with the code from your page.
Aligned DKIM signature
Sendity checks the signature against the key in DNS. It must cover the From line and come from the same domain or a subdomain.
Your decision per campaign
By default, an email without a matching signature is refused. You can relax this per campaign and accept the code alone.
What proves the From address?
An SPF check compared with the aligned DKIM signature Sendity checks.
| Aspect | SPF check | With Sendity |
|---|---|---|
| Checks | Sending server against the envelope domain | Signature of the domain in the From address |
| Visible From address | Not covered on its own | Covered |
| Forwarding | Breaks | Holds if unchanged |
| Mailing lists | Breaks | Breaks if the list changes the message |
What to check on your own domain.
The same checks decide whether your own emails arrive.
DKIM for every sender
Your mail server and every newsletter or shop tool that sends in your name should sign with your domain.
An SPF record that fits
List all services that send for you, and nothing else.
DMARC, step by step
Start with p=none and reports, then tighten. Large mailbox providers expect DMARC from bulk senders.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
DKIM, SPF and DMARC: common questions.
Why does Sendity not use SPF?
SPF checks the envelope, not the From address, and fails on forwarding. For the question “did this inbox send the message?” it adds little. The decision rests on the aligned DKIM signature.
Do Gmail, Outlook and GMX sign with DKIM?
Yes, the large mailbox providers sign outgoing mail with their domain. Gaps are mostly in small company domains and old mail servers.
What if a visitor’s email fails the check?
The visitor sees why and can send from another address. If your audience mostly uses company domains without DKIM, you can accept the code alone for that campaign.
Is DKIM the same as encryption?
No. DKIM signs the message so changes and fake senders show. The content stays readable.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Email sign-ups with a proven sender.
Try the live demo on your phone. It takes ten seconds.