Which comes first: SPF, DKIM or DMARC?

SPF and DKIM first, because DMARC has nothing to align to until at least one of them authenticates. Publish SPF, enable DKIM on your senders, then publish DMARC at p=none and use its reports to confirm everything aligns before you enforce.

Yes. SPF and DKIM each authenticate an identity, but only DMARC ties that to the address recipients see and carries a policy that stops forged mail. The major mailbox providers now expect all three from bulk senders.

Can I check all three at once?

Yes: run the full domain health check above and it reads SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI in one pass, explaining each result and the exact record to publish for anything that is wrong.

ConceptSPF, DKIM & DMARC

SPF, DKIM and DMARC explained

SPF, DKIM and DMARC are three DNS records that together prove your email is really from you. SPF lists which servers may send as your domain. DKIM cryptographically signs each message so it can be verified and shown to be unaltered. DMARC ties those two to the address recipients actually see and tells receivers what to do with mail that fails. You need all three: SPF and DKIM each authenticate something, and DMARC is what turns that into protection for your visible sender.

See it on your own domainFull domain health check

Why one record is never enough

Each record covers a gap the others leave. SPF authenticates the envelope sender but not the visible From:, and it breaks when mail is forwarded. DKIM survives forwarding and proves the message was not altered, but on its own it does not say what to do if it fails. DMARC binds an SPF or DKIM pass to the From: domain the recipient reads and carries the policy, quarantine or reject, that actually stops forgery. Remove any one and a real spoofing path reopens.

The order to set them up

Publish SPF first, listing every service that sends as you in a single record. Enable DKIM on each of those services and publish their keys. Then publish DMARC at p=none with a reporting address, read the reports until you are sure every legitimate sender aligns, and move to quarantine and then reject. SPF and DKIM are the locks; DMARC is turning the key, and the reports are how you know it is safe to turn.

How they are judged together

A receiver runs all three and DMARC takes the result. DMARC passes if either SPF or DKIM passes and the authenticated domain aligns with the visible From:. That is why you do not need both SPF and DKIM to pass on every message, but you want both configured, because they fail in different situations and either one can carry alignment when the other cannot.

Common questions

Which comes first: SPF, DKIM or DMARC?: SPF and DKIM first, because DMARC has nothing to align to until at least one of them authenticates. Publish SPF, enable DKIM on your senders, then publish DMARC at p=none and use its reports to confirm everything aligns before you enforce.
Do I need all three?: Yes. SPF and DKIM each authenticate an identity, but only DMARC ties that to the address recipients see and carries a policy that stops forged mail. The major mailbox providers now expect all three from bulk senders.
Can I check all three at once?: Yes: run the full domain health check above and it reads SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI in one pass, explaining each result and the exact record to publish for anything that is wrong.