Safety
SPF vs DKIM vs DMARC for Domain Email OPSEC
December 18, 2025
SPF vs DKIM vs DMARC is a stack decision, not a pick-one DNS beauty contest. SPF lists which servers may send mail for the domain. DKIM signs messages so receivers can verify they were not altered in transit. DMARC tells receivers what to do when SPF/DKIM fail alignment, and it is the policy layer that actually changes spoofing outcomes. A public site with a custom domain used in From: lines needs all three. RoastMyOpsec looks up public SPF and DMARC TXT records on the apex — it does not send mail or test inboxes.
The practical difference
SPF answers 'may this IP send as this domain?' It breaks when you add a new ESP and forget to update the record, or when you hit the DNS lookup limit.
DKIM answers 'did this exact message come from a key we publish?' It survives forwarding better than SPF in many paths, which is why DMARC alignment cares about both.
DMARC answers 'if this mail fails, should the receiver monitor, quarantine, or reject — and where do reports go?' Without DMARC, SPF and DKIM are homework with no teacher.
How to choose a rollout order
Publish SPF for current senders. Turn on DKIM at each ESP. Add DMARC at p=none with a rua mailbox you will actually read. Move to quarantine, then reject, once legitimate mail authenticates.
Do not jump to p=reject on day one if marketing, billing, and a founder Gmail all send as the domain. Inventory senders first.
| Record | Job | Failure mode | Takeaway |
|---|---|---|---|
| SPF | Authorize sending IPs / includes | Too many lookups; missing ESP include | Keep the include list current |
| DKIM | Cryptographic signature | Selector not published; mail rewritten | Enable per provider, not once globally |
| DMARC | Policy + reporting + alignment | p=none forever; no monitoring | Policy is what changes attacker success |
When a marketing site still needs this
Even if the website is static, the domain is a costume. Invoice fraud and fake 'CEO' mail work because customers trust the domain they typed into a browser.
If you do not send mail, you can still publish a tight SPF (-all) and a DMARC reject policy so nobody else sends either. Confirm with whoever owns Google Workspace, Microsoft 365, or the ESP before you lock it.
Common mistakes
The first mistake is SPF ~all with a false sense of safety and no DMARC.
The second mistake is a DMARC record with nowhere to send reports.
The third mistake is authenticating the root domain and forgetting a sending subdomain used by the ESP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Do I need SPF, DKIM, and DMARC or just one?
- You need the stack. SPF and DKIM provide signals. DMARC is the policy that tells receivers what to do and whether those signals must align with the From domain.
- What DMARC policy should a small site start with?
- Start at p=none, read aggregate reports, fix failing sources, then quarantine, then reject. Skip ahead only if you are sure every sender is authenticated.
- Can a URL scan prove DKIM works?
- A public DNS lookup can show SPF and DMARC records. DKIM selectors are per-provider. RoastMyOpsec does not send test messages; confirm DKIM in your ESP and in DMARC reports.