SPF, DKIM and DMARC vs Spam Filtering

Authentication and Filtering Do Different Jobs

A useful distinction is identity versus intent. Email authentication provides evidence about whether a message is authorized for the domain it claims to represent. Spam filtering considers whether the message should be delivered based on a wider set of sender, connection, content, reputation, and policy signals.

Passing authentication does not mean a message is useful or trustworthy. A legitimate marketing platform can send unwanted bulk mail. An attacker can register a new domain, configure its authentication correctly, and send deceptive messages from it. Authentication may accurately confirm the attacker controls that domain.

Likewise, a legitimate message can fail authentication because a sender or forwarding service is misconfigured. That is why businesses need controls that work together rather than treating one DNS record as a complete spam solution.

What SPF Does

Sender Policy Framework, or SPF, is a DNS record that identifies which servers are authorized to send email for a domain. During delivery, the receiving system can compare the connecting server with the SPF policy for the envelope sender domain.

Publishing SPF for your own domain helps other mail systems evaluate mail claiming to come from your sending infrastructure. It does not create a filter for every message arriving at your business. This is the source of a common misunderstanding: “We set up SPF, so why do we still receive spam?” Because SPF mainly helps receivers evaluate claimed sending authorization; it is not a general inbound block list.

What DKIM Does

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to an outgoing message. The receiving server retrieves a public key from DNS and uses it to verify that the signed parts of the message have not been altered and that the signing domain took responsibility for it.

DKIM can survive many normal mail-routing scenarios better than checks based only on the connecting server. But a valid signature still does not promise that the content is wanted. It confirms the signature, not the sender’s intentions.

What DMARC Does

Domain-based Message Authentication, Reporting and Conformance, or DMARC, builds on SPF and DKIM. It checks whether an authenticated domain aligns with the domain visible to the user in the From address. The domain owner can publish a policy requesting that failing messages be monitored, quarantined, or rejected, and can request reports.

DMARC is valuable for reducing direct spoofing of a protected domain and understanding who sends mail using that domain. It does not replace broader inbound filtering because it focuses on authentication and alignment, not every reason a message may be unwanted.

SPF, DKIM, DMARC, MX, and Filtering Compared

Why Authenticated Mail Can Still Be Spam

• The sender controls its own domain and has configured authentication correctly
• A legitimate platform is being used for unwanted bulk campaigns
• A previously reputable account or service has been compromised
• The message is technically authentic but irrelevant or repeatedly unwanted
• The sender impersonates a brand using a lookalike domain rather than directly spoofing it

Authentication results are valuable signals for a filtering system, but they are not the whole decision.

What a Business Normally Needs

Maintain accurate SPF for authorized sending services, enable DKIM wherever your provider supports it, and deploy DMARC carefully with reporting and a policy appropriate to the domain. These measures help protect your identity and improve the quality of authentication evidence available to receiving systems.

Separately, review how incoming mail is filtered. If unwanted messages affect several users or public addresses, domain-level inbound filtering may be appropriate. It can use authentication results alongside other signals, then hold suspicious mail in quarantine and provide logs for administrators.

Do not delete or rewrite authentication records merely because you are changing the inbound MX route. Each record has its own purpose, and outbound services still need accurate authorization.

Where SpamVest Fits

SpamVest provides inbound filtering before mail reaches your current mailbox provider. The domain’s MX records direct incoming mail to the filter; accepted mail continues to Microsoft 365, Google Workspace, cPanel, or another existing host.

SpamVest does not replace SPF, DKIM, or DMARC and does not host or send your email. It adds the inbound decision layer, with quarantine, logs, sender allow lists, sender block lists, and advanced regex-based filters available through antispam cloud for each protected domain.

Frequently Asked Questions