Guide
Read an email authentication result
A passing SPF or DKIM result is only part of the story. DMARC asks whether a passing identity aligns with the address people see in From.
Separate the identities
SPF authorizes the sending IP for the SMTP envelope identity, often called the Return-Path or MAIL FROM domain. It does not authenticate the visible From field by itself. DKIM verifies a signature over selected headers and the body using a public key published under the signing domain's selector; the d= domain in that signature is the authenticated DKIM identity. A message can have more than one signature.
DMARC checks the domain in the visible From field against those authenticated identities. A message passes DMARC if at least one passing SPF or DKIM identity also aligns with the From domain under the published strict or relaxed alignment mode. A valid DKIM signature from an unrelated domain, or SPF pass for an unrelated bounce domain, is not enough. This is why forwarding can break SPF yet still pass through an aligned DKIM signature, while a mailing-list rewrite can change what aligns.
Change records in a controlled order
- List every legitimate sender and its envelope and signing domains. Check what their receivers report before editing DNS. For SPF, authorize only the sending infrastructure that actually uses the domain and keep one coherent policy record.
- Publish each DKIM selector's public key and verify that sent messages sign with an appropriate
d=domain. A DNS key existing by itself does not prove that mail is being signed or accepted. - Start DMARC in a monitoring posture such as
p=nonewith aggregate reports sent to an address you control. Read the reports for alignment failures, then move to stronger handling only when legitimate flows are accounted for. RFC 9989, published in 2026, is the current DMARC specification; do not copy retired tags from older examples without checking their status.
MTA-STS solves a different problem. It lets a receiving domain publish a policy for TLS-protected SMTP delivery to its MX hosts. It does not replace SPF, DKIM or DMARC, and its testing and enforce modes have different delivery consequences. The email diagnostic tool planned for this site is not live yet; use sender and receiver reports to validate any change.