SPF, DKIM, and DMARC all work together to increase trust of your domain and delivery of your email to inboxes. But, the important thing to remember is that the recipient email system is free to handle your e-mails in any way they want. So, it is not guaranteed that any one or more of these mechanisms are implemented properly.
The biggest thing about SPF and DKIM alone, is that it does nothing to insure that the from header is authenticated. This is the e-mail address that your recipient sees in their mail client. So, they are not effective for determining if what the end user sees is authentic.
For SPF, it only checks the domain specified in the return-path header (aka Envelope From) in the SMTP message. This isn't an address the end-user sees.
For DKIM, it only cares about the domain specified in the d= parameter in the dkim-signature header. Again, the end-user does not see this.
DMARC fixes this. DMARC requires "alignment" to be correct on either SPF or DKIM.
- For SPF to be in "alignment" the domain in the
from header must match the domain in the return-path header. This is rarely possible when sending e-mail through third party bulk mail providers because the return-path is where bounces, and complaints go that the provider tracks and is often an email address managed by the third party. This is why you see SPF failures in your DMARC reports.
- For DKIM, the domain specified in the
d= field in the dkim-signature header must match the domain in the from header. This can be accomplished by making sure the third party sender (i.e. Mailchimp) is properly configured for DKIM signing and you have added the appropriate DNS records to your domain.
This "alignment" check ensures that what the end-user sees in their e-mail client is authenticated by either SPF or DKIM. If a passing SPF record or DKIM record is in alignment with the from header (what the end user sees), the message passes DMARC. Otherwise, it fails DMARC.
Note that these protocols are only scrutinizing the “domain name” portion of the email address. The portion after the @ sign. None of these check the validity of the username portion. The portion before the @ sign.
So, you can see that both SPF and DKIM are necessary for DMARC to be fully functional. All 3 are necessary for proper mail flow. And, not all recipient email systems implement the standards in the same way or correctly.
A huge frustration for systems administrators is that a ton of senders still have not configured these 3 standards properly when sending e-mail. And, sadly, rarely are the above basic principles properly explained anywhere.
