--- title: Email Authentication SPF DKIM DMARC — RGM® Glossary url: https://realgrowthmatters.com/glossary/dmarc-spf-dkim/ updated: 2026-06-10 source_html: https://realgrowthmatters.com/glossary/dmarc-spf-dkim/ --- # Email Authentication (SPF, DKIM, DMARC) S·P·F / D·K·I·M / D·M·A·R·Cnoun Proof of sender, in DNS — three records that decide whether your mail lands, and mandatory table stakes since 2024. Term : SPF / DKIM / DMARC Prove : Mail really comes from the domain Live in : DNS records the receivers check Since Feb 2024 : Required by Gmail/Yahoo for bulk senders ## Forms & parts of speech email authentication · noun The sender-proof triad. "Deliverability collapsed because **DMARC** was missing - Gmail now asks every bulk sender for proof of identity." ## Definition in plain terms SPF, DKIM, and DMARC are the three DNS-based standards that prove an email genuinely comes from the domain it claims — the identity layer of EMAIL DELIVERABILITY. SPF publishes which servers may send for your domain; DKIM cryptographically signs each message so tampering and forgery show; DMARC ties them together with an alignment requirement and a published policy telling receivers what to do with failures. Since February 2024, Gmail and Yahoo require all three disciplines of bulk senders — authentication stopped being best practice and became the toll for the inbox. ## The mechanics Each layer answers a different forgery. SPF (Sender Policy Framework) is an allowlist in DNS: receivers check the connecting server against the domain's published list — strong against direct impersonation, brittle through forwarding. DKIM (DomainKeys Identified Mail) signs headers and body with a private key whose public half lives in DNS: receivers verify the signature, proving the content left the signer intact and survives forwarding. DMARC closes the hole both leave: it requires alignment — the From: domain the human sees must match the domain SPF or DKIM validated — and publishes policy (none/quarantine/reject) plus reporting addresses, so the domain owner both instructs receivers and learns who is sending as them (the aggregate reports are a standing audit of every ESP, tool, and forgotten system mailing under the brand). The 2024 turn made this marketing infrastructure: Gmail and Yahoo's bulk-sender rules (5,000+ daily messages) require SPF and DKIM, a DMARC record at minimum p=none, From-alignment, one-click unsubscribe, and spam-rate ceilings — with non-compliance priced in deferrals and rejections. The operating disciplines: inventory every legitimate sender before tightening policy (the p=none reporting phase exists to find the marketing-automation tool nobody remembered), move to quarantine/reject deliberately as alignment reaches 100%, and treat authentication as brand protection too — a reject policy is what stops phishers from wearing your domain into your customers' inboxes. ## When it matters Email authentication matters to anyone sending mail that matters — marketing, transactional, sales sequences — because the receivers now demand it and the From: line is a brand asset phishers covet. It matters acutely at ESP migrations, new-tool additions, and subdomain strategies, where alignment quietly breaks. The discipline is staged: publish all three records, read DMARC reports until every legitimate stream aligns, then enforce — and keep the reports flowing, because the senders-as-you list changes every time someone signs a SaaS contract. **Worked example.** A retailer's promotional email - 2 million sends a month - starts deferring at Gmail in March 2024: the domain has SPF (last touched years ago), partial DKIM, and no DMARC record at all, which now fails the bulk-sender bar outright. The remediation runs in stages: DMARC publishes at p=none with reporting on day one (compliance restored, intelligence flowing), and the reports immediately earn their keep - six legitimate senders surface (two ESPs, the receipt system, a survey tool, sales sequencing, and a regional team's forgotten newsletter platform), three of them unaligned. Each stream gets DKIM-signed and aligned over six weeks; the unknown senders that remain in the reports turn out to be phishers, which settles the endgame: policy steps to quarantine, then reject. Inbox placement recovers past its pre-2024 baseline - and the security team sends the email team a thank-you, because the reject policy ended a customer-phishing campaign marketing never knew was wearing its domain. **Failure modes to watch.** No DMARC record while the 2024 rules price it in deferrals; tightening to reject before the report phase finds every legitimate sender; new tools mailing unaligned because nobody owns the sender inventory; subdomain strategies breaking alignment silently; and treating authentication as IT's chore when the From: line is marketing's brand asset. ## Synonyms & antonyms ### Synonyms email authenticationSPF/DKIM/DMARCDMARC ### Antonyms unauthenticated mailspoofed sender ## Origin & history SPF and DKIM emerged in the 2000s as email's forgery answers, and DMARC (2012, a collaboration of major senders and receivers) tied them into alignment, policy, and reporting; Gmail and Yahoo's February 2024 bulk-sender requirements converted the triad from deliverability craft into mandatory marketing infrastructure. Etymology: [source](https://dmarc.org/). ## Usage trends Search interest for this term over the last five years: [View interest-over-time on Google Trends →](https://trends.google.com/trends/explore?q=dmarc&date=today%205-y) ## Common questions What do SPF, DKIM, and DMARC each do? : SPF publishes which servers may send for the domain; DKIM cryptographically signs messages; DMARC requires the visible From: to align with what passed, publishes failure policy, and reports who sends as you. What did the 2024 bulk-sender rules require? : Gmail and Yahoo require bulk senders (5,000+/day) to have SPF, DKIM, a DMARC record (at least p=none), From-alignment, one-click unsubscribe, and low spam rates — priced in deferrals and rejections since February 2024. How should DMARC be rolled out? : Staged — publish at p=none and read the reports until every legitimate sender aligns, then step to quarantine and reject; the reject policy is also what stops phishers wearing your domain. ## Related tools & calculators - tool[A/B test sample size](/tools/a-b-test-sample-size/) ## Resources & people to follow - reference[Google — email sender guidelines](https://support.google.com/a/answer/81126) - reference[DMARC.org — the specification](https://dmarc.org/) - referenceRGM analysis — inventory senders at p=none, then enforce; the From: line is a brand asset worth a reject policy Curated, non-competitor resources verified per term. ## Related training - module[Performance marketing](/training/performance-marketing-foundations/) ## Disciplines Areas of marketing where email authentication (spf, dkim, dmarc) is a core concern: [Performance marketing](/training/performance-marketing-foundations/)[Growth strategy](/training/growth-marketing-foundations/) ## Read next ## Related terms [Email deliverability](/glossary/email-deliverability/)[Email marketing](/glossary/email-marketing/)[Cold email](/glossary/cold-email/)[CAN-SPAM Act](/glossary/can-spam-act/)[CASL](/glossary/casl/) ## Sources 1. trends[Google Trends — "dmarc"](https://trends.google.com/trends/explore?q=dmarc&date=today%205-y)