Recommended Free Tools
SPF authorizes sending systems for an email’s technical envelope identity; DKIM checks a domain-associated signature on the message; and DMARC checks whether at least one of those authentication results aligns with the domain readers see in the From address. That alignment is the key: SPF or DKIM can pass on its own without the message passing DMARC.
What are SPF, DKIM, and DMARC?
Think of them as three related checks, not three versions of the same check. The analogy below is simplified; each mechanism evaluates specific email identities or data.
- SPF: “Is this sending system allowed to use this envelope identity?” The receiver checks the connecting host against a domain owner’s SPF policy in DNS for the SMTP MAIL FROM or HELO identity. SPF does not directly authenticate the human-readable From address. RFC 7208
- DKIM: “Does this message carry a signature that verifies for a signing domain?” The receiver uses the domain’s published key to check the signed portions of the message. A valid signature authenticates those portions in relation to the signing domain; it does not, by itself, establish that the domain matches the visible From address. RFC 9989
- DMARC: “Does at least one passing authentication result belong to the domain shown in From, and what policy did that domain publish?” It connects SPF and DKIM results to the visible author domain and lets the domain owner state a preferred handling policy and receive reports. RFC 9989 RFC 7489
What is the difference between SPF, DKIM, and DMARC?
| Mechanism | What it checks | What the domain owner publishes | What a pass can establish | Common operational snag |
|---|---|---|---|---|
| SPF | Whether the connecting host is authorized for the evaluated SMTP MAIL FROM or HELO identity | An SPF policy in DNS as a TXT record | The host is authorized for that SMTP identity; DMARC can use the pass if the identity aligns with the visible From domain | Forwarding can change the sending host, causing SPF to fail |
| DKIM | Whether the signature verifies for its signing domain and the signed message portions | Public key information in DNS, identified by a selector supplied by the signing service | The signature verifies for the signing domain; DMARC can use the pass if that domain aligns with the visible From domain | Changes to signed message content can invalidate the signature |
| DMARC | Whether a passing SPF or DKIM identifier aligns with the domain in the visible From address | A DMARC policy in DNS for the author domain | At least one aligned SPF or DKIM mechanism passed, subject to the receiving system’s evaluation | Legitimate indirect mail flows or unconfigured senders can fail or produce unaligned results |
The technical distinction matters because the visible From address is what a recipient sees, while SPF evaluates a separate SMTP identity and DKIM evaluates a signing domain. DMARC ties those checks to the visible author domain.
How do SPF and DKIM work with DMARC?
DMARC passes when either SPF or DKIM passes and its authenticated domain aligns with the domain in the RFC5322.From author address. Both mechanisms do not have to align for DMARC to pass, though a sender may need to configure both for a provider’s separate requirements.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- SPF path: The receiver checks the connecting host against the policy for the evaluated MAIL FROM or HELO identity. If SPF passes and that authenticated domain aligns with the visible From domain, SPF contributes a DMARC pass.
- DKIM path: The receiver verifies the message’s DKIM signature using the signing domain’s published key. If the signature passes and the signing domain aligns with the visible From domain, DKIM contributes a DMARC pass.
- DMARC result: If at least one aligned path passes, DMARC passes. A standalone SPF pass or valid DKIM signature without alignment is not enough.
For example, a company may show billing@example.com in From while a service sends the message using its own domain for MAIL FROM. SPF could pass for that service’s domain, but it would not contribute to DMARC unless the authenticated SPF domain aligns with example.com. A valid DKIM signature from an aligned example.com signing domain could still make DMARC pass.
Why does DMARC alignment matter?
Alignment connects the technical authentication result to the domain a recipient is being asked to trust. Without that connection, a message could pass SPF for a service’s unrelated envelope domain or carry a valid signature from an unrelated signing domain while claiming a different author in From. DMARC requires at least one passing identifier to align with that visible author domain.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Alignment is domain authentication, not proof that a particular employee sent a message, that its claims are true, or that its links and attachments are safe. DMARC is not a content-safety check.
What do DMARC policies and reports do?
A domain owner publishes a DMARC policy to express preferred handling when messages claiming that domain fail DMARC. The policy also supports reporting, which can help identify authentication failures and mail that appears to use the domain. Receivers retain local discretion, and the policy is not a universal delivery command. The standard describes the policy purpose as allowing owners to assert preferred handling of authentication failures. RFC 7489
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Google recommends setting up DMARC reports to monitor mail sent from, or appearing to be sent from, a domain. Google’s Gmail sender guidelines
How to set up SPF, DKIM, and DMARC safely
Exact DNS values depend on your mail host and every service that sends for your domain. Use the records and instructions supplied by those services; the sequence below is a rollout approach, not a universal timeline or a guarantee that enforcement is safe.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Inventory every sending source. List human mail, website forms, applications, transactional notifications, marketing systems, invoicing tools, and support desks that send using your domain. Missing a legitimate source can lead to failures after a stricter policy is applied.
- Configure SPF for the relevant envelope domain. Include all authorized senders according to their instructions. Avoid publishing multiple SPF records for one domain name and avoid uncontrolled DNS lookup expansion; consult RFC 7208 and the sending provider’s setup guidance.
- Enable DKIM for each service that supports it. Publish the selector and key DNS information the service provides. Then check delivered message headers to confirm signatures verify and note the signing domain. A published key or passing signature does not alone establish From alignment.
- Publish DMARC for the author domain. Choose an initial policy appropriate to your operational posture. If you use a monitoring policy, inspect aggregate reports for legitimate sources that fail or do not align, correct those configurations, and only then consider stricter handling.
- Test real messages at major destination providers. Inspect message headers for SPF result, DKIM result and signing domain, DMARC result, and alignment against the visible From domain. Test messages from each sending source, not just one mailbox.
Forwarding and mailing lists can alter the message path or message content, complicating SPF and DKIM results. The IETF’s discussion of indirect email flows explains these interoperability issues. RFC 7960 A clean result in one mail path does not prove every indirect route will behave identically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Gmail and Outlook.com currently require
Provider rules are not universal email standards. The following thresholds and expectations are specific to the named consumer services and reflect their published guidance as checked on October 4, 2026; check the live pages before relying on them because requirements can change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Gmail
Google says all senders to personal Gmail accounts must set up SPF or DKIM. Senders delivering more than 5,000 messages per day to Gmail accounts must set up both SPF and DKIM and publish DMARC. For direct mail, the From domain must align with either the SPF domain or the DKIM domain; Google’s FAQ says both SPF and DKIM must be set up, while only one needs to align for its sender-alignment requirement. Google also says enforcement of non-compliant traffic is ramping up from November 2025. See the live Gmail email sender guidelines and Gmail sender guidelines FAQ.
For third-party email service providers, Google advises senders to verify that the provider authenticates their domain’s mail with SPF and DKIM. It also recommends DMARC reports for monitoring. Gmail sender guidelines FAQ
Outlook.com and Microsoft consumer email services
Microsoft defines a high-volume sender for this guidance as one sending 5,000 or more messages to Microsoft consumer email services using the same 5322.From domain. It expects those senders to publish SPF and DKIM records and have both checks pass, publish a DMARC record, and pass DMARC validation through at least one aligned SPF or DKIM mechanism. This is Microsoft’s Outlook.com/consumer-service guidance, not a rule that automatically applies to every mailbox provider. See Microsoft’s 550 5.7.515 guidance.
Quick Recap
What authentication does not guarantee
- Inbox placement: Passing authentication does not guarantee inbox delivery. Provider reputation, recipient complaints, infrastructure, consent, and message practices also matter; Google’s sender guidance includes requirements beyond authentication. Google’s Gmail sender guidelines
- Safe or truthful content: These mechanisms authenticate domains and message signatures, not the truth of a message’s claims or whether its links and attachments are safe.
- Identical results on every route: Forwarding and mailing lists can change authentication outcomes, so a message may behave differently in an indirect flow. RFC 7960
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
