SPF, DKIM and DMARC explained
SPF, DKIM and DMARC are three separate DNS texts that together answer one question: may this message stand as your domain? SPF says who may send as your domain, DKIM proves that the message really was that, and DMARC couples the two and determines what must happen when they fail.
Do not confuse the layers: an SPF that allows everything does not make DKIM superfluous, and a DMARC on p=reject does not save a message whose signature does not compute. Each layer measures something different, and the Mail security tool measures all of them — MX, SPF, DMARC, DKIM keys and their bits, BIMI, MTA-STS, TLS-RPT and DANE in one picture, with a grade that counts only measured layers.
This article explains what each layer answers, in which order you practically set them, and which measurement you should have at hand before you close DMARC.
SPF: who may send
An SPF text is a list of parties that may post as your domain, with the lookup limit of RFC 7208 as boundary: ten queries, then it is done. An include you no longer recognise — from an old mail service, a CRM, a billing system — is the most common leak. Whether a specific IP address passes through it, the SPF recomputation recalculates, include chain by include chain; How to check whether an IP is in your SPF is the practical elaboration of that.
DKIM: the signature on the message
DKIM places a cryptographic signature on the message itself; the receiver fetches the public key at the selector in your DNS and recomputes the body-hash. Where SPF checks an address, DKIM checks the content — and a selector with a 512-bit key is weak material these days. DKIM verification redoes that same recomputation in your browser: paste the source text of a message and the signature computes or it does not.
DMARC: the decision upon failure
DMARC is the master above SPF and DKIM: it says which alignment is required, what must happen upon failure (none, quarantine, reject), and where reporting goes. Never set it directly on p=reject without measurement data: begin on p=none, read aggregate roofs for a few weeks, and tighten toward reject on the basis of what the roof shows — you learn to read it in Reading a DMARC aggregate roof.
Measure before you close
The order that works: first measure what is already travelling as your domain (roof), check who currently passes your SPF (SPF recomputation), and see whether your DKIM selectors compute before you close anything. Mail security gives the whole picture of one domain at once — including BIMI and MTA-STS, which only become relevant later once the basis stands.