MX, SPF, DKIM and DMARC explained in five minutes

These four records confuse people because they sound related and are not. Each solves a different problem, and they were invented decades apart to patch holes in a protocol designed when everyone on the internet trusted everyone else.

MX — where mail goes

The only one about receiving. It maps a domain to the server that accepts its mail. Without it, senders have nowhere to deliver and your mail bounces. With the wrong one, your mail goes somewhere you don't control.

SPF — who may send

A published list of servers allowed to send as your domain. The receiving server checks the connecting IP against it. Its blind spot: SPF checks the envelope sender, which is often not the From: address a human sees. That gap is why DKIM and DMARC had to exist.

DKIM — proof it was not tampered with

Your provider signs outgoing mail with a private key; the matching public key sits in your DNS. The receiver verifies the signature. This survives forwarding, which SPF does not, and it proves the message body was not altered in transit.

DMARC — what to do when the checks fail

DMARC ties the other two to the visible From: address — the concept is called alignment — and tells receivers what to do on failure:

• p=none — do nothing, just send me reports
• p=quarantine — put it in spam
• p=reject — refuse it outright

A message can pass SPF and still fail DMARC, which is the single most confusing thing here. If your envelope sender is bounces.provider.com and your From: is you@yourbrand.com, SPF passes for the provider but is not aligned with your domain. DKIM signed with d=yourbrand.com rescues it — which is why DKIM is the one you must not skip.

What breaks, in order of likelihood