Three protocols, three jobs
SPF authorizes servers for an envelope-from domain. DKIM signs message content with a domain-controlled key. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain and publishes a policy for failures.
They work together but are not interchangeable. A valid SPF record does not create DKIM, and a DKIM signature from an ESP domain may pass without aligning to the brand in the From address.
Check the delivered message
DNS shows what is published; headers show what the actual route used. Send through the production ESP or CRM and inspect the return path, DKIM `d=` domain, selector, Authentication-Results, and visible From address.
This catches the common situation where an admin screen says a domain is verified but one message stream still uses provider-owned or broken identities.
Roll out DMARC without breaking mail
Inventory every legitimate sender, enable reporting, configure aligned authentication, and move from monitoring toward enforcement only when important streams are understood. Billing, support, product, and regional systems are easy to forget.
Use the dedicated SPF, DKIM, and DMARC alignment guides for exact domain comparisons and pass logic. The overview should orient the investigation, not substitute for the delivered evidence.
Authentication is necessary, not sufficient
A fully aligned message can still be unwanted, complaint-heavy, linked to a compromised site, or sent after an extreme volume jump. Providers combine identity with reputation, behavior, content, and recipient context.
Fix authentication first because it is foundational and controllable. Then run a placement test and continue the diagnosis with provider and audience evidence.