Your Mail Lands in Spam: SPF, DKIM and DMARC in Plain Words

SPF, DKIM and DMARC Explained to a Spamhead

The sender checks all three, alignment with the visible address is the hidden hurdle. The DMARC policy record can help guide what From addresses will succeed.

Looking at your email headers, where some popular mailbox providers send rejected messages, can reveal which anti-spam authentication test your domain failed. But a passing SPF or DKIM check alone may not be enough to keep an email out of the spam folder. Safe delivery also depends on how the mail is scanned for DMARC.

DMARC, defined in RFC 7489, builds on SPF (RFC 7208) and DKIM (RFC 6376) for email authentication and DKIM defined.

The core mechanism added by DMARC is "alignment": SPF and DKIM passes only count as valid if the authenticated domain is an acceptable facsimile of the visible From address, not just any From domain.

SPF, DKIM, and DMARC defined

SPF, DKIM, and DMARC are distinct mechanisms, though DMARC depends on the reliability of the other two.

-

The envelope sender is often a trusted address, like @someisp.yahoo.com, not the visible From address. SPF looks only at the sending domain of this envelope.

• DKIM signs the message itself, including headers, but does not directly validate the visible From address. DKIM's signature includes a domain, the d= domain, which this article names the authenticated domain.

• DMARC uses both SPF and DKIM outcomes as test inputs. SPF has the envelope address to check. DKIM has its own signed domain. And DMARC has a visible From address, the address the user sent to. DMARC checks that all three line up.

DMARC rejects a passing DKIM for a misaligned From

A DKIM signature validates the mail if the signature is there and corresponds to the domain in the d= parameter. DKIM can align or not, and it can pass or fail, independently. Alignment is whether the signed domain matches the email From domain by the DMARC policy's definition.

That DKIM.pass result, alone, does not ensure DMARC delivery. DMARC only approves if the authenticated domain is aligned with the visible From. The alignment test uses the envelope sender's domain SPF check, or the DKIM signature's d= domain, or both. If either aligns, the message is allowed to reach the inbox. Both can pass, but SPF and DKIM may not have aligned.

However, DKIM might pass and pass aligned, but a receiver could still block the mail. This might happen if the receiver applies additional policies beyond DMARC requirements.

If you look at a header and see DKIM=pass and DMARC=fail, identifying the fail could be harder. The Authentication-Results header, standardized in RFC 8601, exposes what happened during transport.

Authentication-Results names the fail

The Authentication-Results header has a field for each active check: SPF, DKIM, and DMARC. Like this:

Authentication-Results: example.com; spf=fail smtp.mailfrom=myoriginaldomain.example.com; dkim=pass [email protected]; dmarc=fail (p=reject dis=none)

Reader, check your Authentication-Results header for a phrased like these:

spf=fail dkim=fail dmarc=fail

That sequence tells you, inversely, what each rule returned before compilation. Only a DMARC fail would force a spam check, but a mailox can spam a still-Inboxed mail after discovery of DKIM fail or SPF fail.

Bad results for missing, insecure, or wrongful DKIM signatures

If DKIM=pass, then the receiving server saw the DKIM header and checked it, but did not find the signature on the headers. A DKIM pass means valid authentication, if no misalignment.

The authentication success may still be "secure" or "signature is there, but DMARC policy enforces this mailbox as needed". Since DMARC use is voluntary, domains might set DMARC to none, or explicitly declare policy none and skip alignment altogether. Passing DKIM's purely technical test, then, availed the email nothing in these places.

Only the DKIM header was checked securely, and it passed. This means the header was present, and the body had the matching signature, and the two worked. Here is a common DKIM fail:

Authentication-Results: example.com (following RFC 8601 [](https://datatracker.ietf.org/doc/html/rfc8601); dkim=fail [email protected] [email protected] "email was DKIM signed but validation failed")

These failures, showing domains where the DKIM signature passed only "email was DKIM signed", would route to spam, whether SPF aligned or not. Even domain.mysigneddkimdomain.example.com, the DKIM d= address, and salient extras such as the header.i= claimed by the DKIM d= dom, were right. The flow did not account for signed domains like yourdomain*/

One may readily misunderstand the conflicting SPF and DKIM domains because SPF says the From header is like this domain: mx.example.com,@pochantasendingmailer.email,mail.enventurezone.com

Which in a few regexes, says SPF aligns its domain, unlike its DKIM alias:

Authentication-Results: example.com; dkim=pass [email protected] 'appears but this domain is not permitted'; dmarc=fail (p=reject dis=none) header.from=marginal.mysigneddkimdomain.example.com

So SPF, DKIM, and DMARC seem complex to senders, and then organizations still may misconfigure them however possible. DKIM authentication could fail from too weak of DKIM selector ranges, which permit mail signed or not. Too-tightly scoped SPF has rejected emails from proper IPs. Misaligned DMARC Froms are a fast point of contact, like yourdomain.com

As from obsoleting their policies or leaving DMARC none, these last, substantive issues, e.g. dis=none, trigger frequent DMARC fails.

Authentication-Results: example.com dmarc=fail (p=none dis=none) header.from=unknownalias.mysigneddkimdomain.example.com

DMARC Feature asked the sending domain to say what action their receiver should take.