SPF, DKIM and DMARC, explained by someone who had to make it work
dev.to·
Email deliverability and security rely heavily on three core DNS mechanisms: SPF, DKIM, and DMARC. However, their interaction often confuses developers configuring transactional email systems. This practical guide demystifies authentication mechanics by explaining the fundamental distinction between the SMTP envelope sender (MAIL FROM) used for bounce routing and the user-facing header From address. It breaks down how DMARC enforces domain alignment—requiring either SPF envelope alignment or a valid cryptographic DKIM signature matching the header domain before passing verification. For backend engineers managing cloud infrastructure, Node services, and transactional communication pipelines, understanding these protocols is critical for protecting domain reputation, preventing spoofing attacks, and ensuring reliable message delivery across external email providers.