| Doc. Number | Article Title | Effective Date | Version |
| FHC-SPF-02 | How to Use DMARC and DKIM Records | October 29, 2026 | 0.5 |
This article describes the differences between DMARC and DKIM Records. It is organized into the following sections:
***For information specific to the Sender Policy Framework (SPF) protocol, see our Help Center article titled Adding an SPF Record.
What is DMARC?
DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol. It builds on the following, widely deployed, protocols:
DMARC adds linkage to the author (“From:”) domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders, to improve and monitor the protection of the domain from fraudulent email.
How does DMARC work?
A DMARC policy allows a sender to indicate that SPF and/or DKIM protects their messages and tells a receiver what to do if neither of those authentication methods passes – such as junk or reject the message. DMARC removes the guesswork from how the receiver handles these failed messages, limiting or eliminating the user’s exposure to potentially fraudulent & harmful messages. DMARC also provides a way for the email receiver to report to the sender about messages that pass and/or fail DMARC evaluation.
In summary, DMARC helps the end user by making it easier for their mailbox provider (e.g., AOL, Comcast, Hotmail, Gmail, Yahoo) to keep spam and phishing messages from ever reaching their inbox.
To access a DMARC Record Checker tool, click this link.
To access a DMARC Record Generator, click this link.
For further information on DMARC, click this link.
What is DKIM?
Domain Keys Identified Message, or DKIM, is a signature-based Email Authentication technique. It is the result of merging the Domain Keys and Identified Internet Mail specifications and has been published as a Standards Track document as RFC4871 in 2007 and updated as RFC6376 in 2011. RFC6376 was updated by RFC 8301, RFC 8463, RFC 8553, and RFC 8616. DKIM lets an organization take responsibility for a message that is in transit.
How does DKIM work?
DKIM attaches a new domain name identifier to a message and uses cryptographic techniques to validate authorization for its presence. The identifier is independent of any other in the message, such as the author's From: field.
To access a DKIM Record Checker, click this link.
More information is available from this link.
IMPORTANT: Forth Support Teams cannot assist clients with configuring their own DKIM and DMARC records.
Article Version History:
| Version | Effective Date | Description |
| Basic | 01/03/2023 | Initial Release |
| 0.1 | 12/13/2023 | Provided updated reference to the status of RFC6376. |
| 0.2 | 12/09/2024 | Made minor grammatical updates but no subject matter updates. |
| 0.3 | 12/15/2025 | Created table of contents; updated DMARC Record Checker hyperlink, and added a sentence to the end of the first DKIM paragraph. |
| 0.4 | 08/14/2026 | Updated the title and made minor formatting updates. |
| 0.5 | 10/29/2026 | Updated language associated with external hyperlinks and updated deprecated hyperlinks. |