DMARC, SPF and DKIM glossary
34 email authentication terms in plain language, from alignment to p=reject. Each definition is short enough to quote and links to a full guide where there is one.
- Written for business owners
- Based on the IETF standards
- Updated 10/10/2026
The three standards
DMARC
Domain-based Message Authentication, Reporting and Conformance. A DNS record at _dmarc.yourdomain that tells receiving servers what to do with email that fails SPF and DKIM alignment for your domain (nothing, spam folder or reject) and where to send reports. Defined in RFC 7489.
SPF
Sender Policy Framework. A TXT record at the root of your domain that lists the servers allowed to send email using your domain in the envelope sender. Receivers compare the sending IP address with that list. Defined in RFC 7208.
SPF explained · SPF checkerDKIM
DomainKeys Identified Mail. A cryptographic signature added to each message by the sending service. Receivers fetch the public key from DNS and confirm that the message came from an authorised service and was not altered in transit. Defined in RFC 6376.
DKIM explained · DKIM checkerHow DMARC decides
Alignment
The DMARC test that matters: SPF or DKIM must pass for a domain that matches the visible From address. A pass for some other domain, such as the sending service’s own, does not count toward DMARC.
DMARC alignment explainedRelaxed and strict alignment
Relaxed alignment, the default, accepts any domain within the same organisational domain, so mail.yourcompany.co.za aligns with yourcompany.co.za. Strict alignment requires an exact match. Set with the adkim and aspf tags.
Organisational domain
The registered domain that DMARC treats as the owner of a message, found by removing subdomains down to the public suffix. For billing.yourcompany.co.za the organisational domain is yourcompany.co.za, because co.za is a public suffix.
Envelope sender
The return address used during delivery, also called the Return-Path or MAIL FROM. Bounces go here and SPF checks it. Recipients never see it, which is why SPF alone cannot stop spoofing of the From address.
From address
The sender address shown to the recipient, also called the header From or 5322.From. DMARC protects this address by requiring SPF or DKIM to pass for a domain that aligns with it.
Policies and tags
p=none
Monitoring mode. Receivers deliver email as normal but send you reports, so you can see every service sending as your domain. The right place to start, and no protection on its own.
Why monitoring-only is not enoughp=quarantine
Mail that fails DMARC is treated as suspicious, usually delivered to the spam folder. The usual middle step between monitoring and full enforcement.
p=reject
Mail that fails DMARC is refused outright and never reaches the recipient. The goal of every DMARC rollout, and the only policy that fully stops exact-domain spoofing.
Rolling out to p=rejectEnforcement
A DMARC policy of quarantine or reject applied to all failing mail. Mailbox providers, insurers and auditors increasingly treat enforcement, not just a published record, as the standard.
Subdomain policy (sp)
The sp tag sets a separate policy for subdomains. Without it, subdomains follow the main policy. sp=reject protects subdomains that never send email.
pct
The share of failing mail the policy applies to, from 1 to 100. Useful as a short step during rollout. Receivers apply the full policy when it is left out.
rua (aggregate reports)
The address that receives aggregate reports: daily XML summaries from each mailbox provider showing how much mail each server sent as your domain and whether it passed.
How to read aggregate reportsruf (failure reports)
The address for failure reports about individual messages. Few providers send them, and those that do can include personal information, so weigh POPIA before enabling them.
SPF in detail
include
The SPF mechanism that pulls in another domain’s SPF record. It is how email services such as Microsoft 365 or Mailchimp are authorised. Each include costs at least one DNS lookup.
SPF lookup limit
SPF allows at most 10 DNS lookups per check, counting include, a, mx, ptr, exists and redirect, including those inside nested includes. Above 10, SPF returns a permanent error and fails for all your mail.
Fixing too many lookupsVoid lookup
An SPF lookup that returns no records, for example an include pointing to a name that no longer exists. More than two void lookups can cause a permanent error.
~all and -all
The end of an SPF record says how to treat servers not listed. ~all is a soft fail, -all is a fail, ?all is neutral and +all authorises everyone, which must never be used.
SPF flattening
Replacing includes with the IP ranges they contain, to stay under the lookup limit. It works only if someone keeps the ranges current, because providers change them without notice.
DKIM in detail
DKIM selector
The name that tells receivers where a public key lives: selector._domainkey.yourdomain. Each sending service uses its own selector, shown as s= in the DKIM-Signature header.
DKIM key length
The size of the RSA key that signs your mail. RFC 8301 requires at least 1024 bits and recommends 2048, which is the standard to aim for today.
ARC
Authenticated Received Chain. Lets forwarders and mailing lists record the authentication results they saw, so a receiver can trust a message whose SPF or DKIM broke in transit. Defined in RFC 8617.
Threats DMARC addresses
Email spoofing
Sending email that uses your exact domain in the From address without permission. DMARC at p=reject stops it at every receiver that checks DMARC.
Spoofing and invoice fraudBusiness email compromise
Fraud that uses a spoofed or hijacked business address to redirect payments or extract data, often by changing banking details on an invoice. The FBI counts it among the costliest forms of cybercrime.
Banking details fraud checklistLookalike domain
A domain registered to resemble yours, such as one with a swapped letter or a different suffix. DMARC cannot stop it, because the attacker controls that domain’s records. Monitoring and staff awareness can.
What DMARC cannot stopParked domain
A domain you own that never sends email. It should publish SPF v=spf1 -all and DMARC p=reject so nobody can send as it.
Third-party sender
Any outside service that sends email as your domain, such as an accounting system, CRM or newsletter tool. Each must be aligned with SPF or DKIM before you enforce DMARC.
Third-party sendersRelated standards and headers
BIMI
Brand Indicators for Message Identification. Displays your logo next to authenticated mail in supporting inboxes. It requires DMARC at enforcement and, at most providers, a mark certificate (VMC or CMC).
MTA-STS
A policy that tells other servers to deliver email to your domain only over verified, encrypted connections. Published with a DNS record and a policy file on your website. Defined in RFC 8461.
TLS-RPT
Reporting for encrypted delivery. A DNS record at _smtp._tls.yourdomain asks senders to report TLS failures when delivering to you. Defined in RFC 8460.
Bulk sender requirements
Rules from Google and Yahoo (2024) and Microsoft (2025) that require SPF, DKIM and DMARC from domains sending large volumes. Mail that does not comply is sent to spam or rejected.
Sender requirementsAuthentication-Results
The header a receiving server adds to record its SPF, DKIM and DMARC verdicts for a message. The most reliable place to see why a message passed or failed.
Email header analyserSee these terms in your own records
Run the free checker on your domain, or ask for a free assessment and we will explain your results in plain language.