| Doc. Number | Article Title | Effective Date | Version |
| FHC-SPF-02 | How to Use DMARC and DKIM Records | August 14, 2026 | 0.4 |
This article was developed to describe the differences between DMARC and DKIM Records.
It is organized into the following sections:
***For information specific to the Sender Policy Framework (SPF) protocol, see the following article: https://support.forthcrm.com/hc/en-us/articles/12854150305683-Adding-an-SPF-Record
What is DMARC?
DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol. It builds on the widely deployed Sender Policy Framework (SPF) and DomainKeys Identified Message (DKIM) protocols, adding linkage to the author (“From:”) domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders, to improve and monitor the protection of the domain from fraudulent email.
How does DMARC work?
A DMARC policy allows a sender to indicate that SPF and/or DKIM protects their messages and tells a receiver what to do if neither of those authentication methods passes – such as junk or reject the message. DMARC removes the guesswork from the receiver’s handling of these failed messages, limiting or eliminating the user’s exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report to the sender about messages that pass and/or fail DMARC evaluation.
In summary, DMARC helps the end user by making it easier for their mailbox provider (e.g. AOL, Comcast, Hotmail, Gmail, Yahoo) to keep spam and phishing messages from ever reaching their inbox.
To access a DMARC Record Checker tool, click HERE.
To access a DMARC Record Generator, click HERE.
For further information on DMARC, go to dmarc.org.
What is DKIM?
Domain Keys Identified Message, or DKIM, is a signature-based Email Authentication technique. It is the result of merging the Domain Keys and Identified Internet Mail specifications and has been published as a Standards Track document by the IETF as RFC4871 in 2007 and updated as RFC6376 in 2011. RFC6376 was updated by RFC 8301, RFC 8463, RFC 8553, RFC 8616. DKIM lets an organization take responsibility for a message that is in transit.
How does DKIM work?
DKIM attaches a new domain name identifier to a message and uses cryptographic techniques to validate authorization for its presence. The identifier is independent of any other in the message, such as the author's From: field.
To access a DKIM Record Checker, click HERE.
More information is available from DKIM.org.
IMPORTANT: The Forth Support Teams cannot assist clients with configuring their own DKIM and DMARC records.
Article Version History:
| Version | Effective Date | Description |
| Basic | 01/03/2023 | Initial Release |
| 0.1 | 12/13/2023 | Provided updated reference to the status of RFC6376. |
| 0.2 | 12/09/2024 | I made minor grammatical updates but no subject matter updates. |
| 0.3 | 12/15/2025 | Created table of contents; updated DMARC Record Checker hyperlink, and added a sentence to the end of the first DKIM paragraph. |
| 0.4 | 08/14/2026 | Updated the title and made minor formatting updates. |