SPF, DKIM, and DMARC: What Actually Determines Email Deliverability

Self-hosting email requires more than basic server setup — three DNS-based authentication standards largely determine whether messages reach the inbox or get flagged as spam. SPF specifies which IP addresses are authorised to send mail for a domain, but only checks the envelope sender, not the visible From address, and breaks when mail is forwarded. DKIM cryptographically signs each message using a private key, making it more robust than SPF since it survives standard forwarding and verifies that headers and body were not altered in transit. DMARC ties both mechanisms together through domain alignment, requiring that a passing SPF or DKIM check matches the From address recipients actually see, and can be configured to deliver aggregate reports on authentication failures. Experts recommend starting DMARC at a monitoring-only policy, reviewing reports over one to two weeks, and then gradually tightening enforcement to quarantine and ultimately reject.