Look up a domain's SPF and DMARC records side by side, inspect DMARC alignment and enforcement policy, and spot authentication misconfigurations that hurt inbox placement.
Checking SPF and DMARC together reveals whether your domain is truly protected against spoofing or merely publishing unaligned DNS records. Under Gmail, Yahoo, and Microsoft 365 bulk-sender enforcement rules, authentication operates as a three-layer stack: SPF validates the connecting IP against your envelope Return-Path, DKIM validates a cryptographic RSA/Ed25519 signature in the message header, and DMARC verifies that at least one of those authenticated domains aligns with the visible From: address shown to the human recipient.
| Scenario | SPF Status & Alignment | DKIM Status & Alignment | Final DMARC Verdict |
|---|---|---|---|
| Direct First-Party Send | PASS (Aligned) | PASS (Aligned) | DMARC PASS (Optimal Inbox Placement) |
| Forwarded Email (No SRS) | FAIL (Forwarder IP) | PASS (Aligned Signature) | DMARC PASS (Saved by DKIM) |
| ESP Send Without Custom Return-Path or DKIM | PASS (Unaligned ESP Domain) | PASS (Unaligned ESP Domain) | DMARC FAIL (Alignment Mismatch) |
| SPF > 10 Lookups + Unsigned Mail | PermError (>10 Lookups) | NONE / FAIL | DMARC FAIL (Quarantined / Rejected) |
Authentication gets your mail accepted at the gateway; list hygiene keeps it in the Primary Inbox. Verify single addresses with our real-time SMTP email validator, scrub CSV/Excel lists in the bulk email cleaner, and read our deep dive on SPF, DKIM & DMARC explained.
SPF authorizes which IP addresses and mail servers may send on behalf of your envelope Return-Path domain. DKIM attaches a cryptographic RSA/Ed25519 signature to message headers. DMARC ties them together by verifying that either the SPF domain or the DKIM d= domain aligns with the visible From: header seen by the recipient, and enforces a disposition policy (none, quarantine, or reject) when both fail.
All senders delivering 5,000+ messages per day to Gmail, Yahoo, or Outlook consumer inboxes must authenticate with both SPF and DKIM, publish a valid DMARC TXT record at _dmarc, maintain valid forward and reverse DNS (FCrDNS/PTR), support RFC 8058 one-click List-Unsubscribe, and keep user spam complaints below 0.3%.
When an intermediate server forwards an email without rewriting the envelope sender (SRS), the connecting IP changes and SPF fails against the original domain. As long as the forwarding server does not alter the signed headers or body, the cryptographic DKIM signature remains valid and aligned with the From: domain, allowing DMARC to pass.
Authentication is a mandatory gatekeeper, not a free pass. Even with enforced SPF, DKIM, and DMARC (p=reject), mailbox providers route campaigns to Spam if your hard bounce rate exceeds 2% or you hit recycled spam traps. Always combine DNS authentication with pre-send SMTP list verification.