SPF: authorize senders
SPF records which services may send using the envelope domain (Return-Path). Passing SPF may still fail alignment with the visible From domain.
DKIM: sign messages
DKIM verifies a cryptographic signature for a signing domain. Validate DNS selector, keys and signing domain in a received message.
DMARC: align and monitor
DMARC checks whether the From domain aligns with SPF or DKIM and offers monitoring, quarantine and reject policies. Identify all legitimate senders before tightening enforcement.
Beyond DNS
Reputation, bounce rates, complaints, sending volume, list hygiene and unsubscribe design also influence delivery. Separating marketing and transactional flows reduces risk.
At a glance
| Control | What it checks | What it cannot guarantee |
|---|---|---|
| SPF | Authorized sender for envelope domain | From alignment or inbox placement |
| DKIM | Signature and integrity | Campaign legitimacy or reputation |
| DMARC | Alignment and policy | Guaranteed reception everywhere |
How SFERE can support
Review DNS and headers, inventory senders, apply staged changes and validate real deliveries; inbox placement cannot be guaranteed.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.