SPF checks whether a sending server is authorized for a domain. DKIM uses a domain’s digital signature to authenticate a message. DMARC adds alignment with the visible From domain: at least one of those mechanisms must both authenticate and align for DMARC to pass. (Google email sender guidelines ↗ · RFC 9989: DMARC)
Jump to a section
Checking a real delivered message
A newsletter arrives with a visible From address at publisher.example. The sender checks the received message’s authentication results to see whether SPF or DKIM passed with a domain aligned to that From domain, then checks the published DMARC policy to understand how failures are handled. A DNS record alone does not prove that this message passed.
What the published policy changes
A published policy can request monitoring, quarantine or rejection of failing messages, while the receiving system makes its own handling decision. Inspect actual delivered-message results after changing an email provider. A correct DNS record alone does not prove your newsletters authenticate or reach the inbox.
Check each sending path when results differ
A newsletter and a receipt can look as if they come from the same brand but use separate sending systems. Inspect a delivered message from each. Save the result alongside the system that sent it so the right owner can fix an alignment problem.