SPF vs DKIM: What's the difference?
SPF authorizes sending infrastructure for a domain, while DKIM cryptographically signs messages so receivers can verify message integrity and signing identity.
SPF
SPF publishes which servers are allowed to send mail for a domain and is evaluated against the SMTP envelope sender.
DKIM
DKIM adds a cryptographic signature to email headers so the receiving server can verify that signed content was not altered in transit.
Key differences between SPF and DKIM
| Decision factor | SPF | DKIM |
|---|---|---|
| What is verified | Whether the sending infrastructure is authorized for an envelope-sender domain. | Whether a cryptographic signature for a signing domain validates over selected message content. |
| DNS record | A TXT record defines allowed sending mechanisms. | A public key is published under a selector in DNS. |
| Forwarding behavior | Can break when forwarding changes the connecting sender. | Can survive forwarding when signed content is not modified. |
Choose SPF if
Use SPF to declare legitimate outbound mail sources for your domain.
Choose DKIM if
Use DKIM to provide cryptographic message authentication and integrity for outgoing mail.
Practical example
A company authorizes Microsoft 365
Can you use SPF and DKIM together?
Deploy SPF and DKIM together because they cover different failure modes. Then use DMARC for domain alignment, reporting and policy. Treat all three as one email-authentication program rather than independent checkbox records.
Common mistake to avoid
Do not keep adding SPF `include` mechanisms until the record becomes unmanageable or exceeds the DNS lookup limit. Also do not enable DKIM without protecting selector keys and monitoring rotation. A “pass” on one mechanism does not by itself prevent visible-domain spoofing without DMARC alignment.
Key takeaway
A strong email authentication setup normally uses both SPF and DKIM, then applies DMARC for alignment and policy.
Frequently asked questions
Is DKIM better than SPF?
They solve different parts of email authentication. A robust setup generally uses both and lets DMARC evaluate alignment.
Does SPF validate the visible From address?
Not directly. SPF evaluates the SMTP envelope identity. DMARC adds alignment with the visible From domain.
Can forwarded email pass DKIM when SPF fails?
Yes. Forwarding can invalidate SPF because the forwarder becomes the connecting server, while an intact DKIM signature may still validate.