BuildFast

SPF: who may send for the envelope domain?

SPF, Sender Policy Framework, is a DNS-published authorization list. The receiving mail server takes the connecting server's IP address and the SMTP identity being checked—normally the MAIL FROM domain, with HELO as another defined identity—and evaluates that domain's SPF policy. The result can pass, fail, soft-fail, or return other defined states (RFC 7208). SPF does not directly prove the human-visible From address.

DKIM: did a domain sign this content?

DKIM, DomainKeys Identified Mail, adds a cryptographic signature header to the message. The header names a signing domain with d= and a selector with s=. The receiver combines the selector and domain to find a public key in DNS, then verifies the signature over the headers and body portions declared by the signer. The private signing key stays with the sending system (RFC 6376).

DMARC: does an authenticated identity align with From?

DMARC begins with the domain in the visible RFC 5322 From header—the identity a reader is meant to see. The receiver checks whether SPF passed with an aligned authenticated domain or DKIM passed with an aligned signing domain. One aligned passing mechanism is enough for DMARC to pass. Alignment can be relaxed, allowing an organizational-domain relationship, or strict, requiring an exact domain match (RFC 7489).