SPF vs DKIM vs DMARC, Explained Like You're a Store Owner
· 8 min read
Three locks, one metaphor: an ID card, a signature, and a rulebook. The plain-English explainer — with a real WooCommerce example.
The three locks, one metaphor
SPF is your ID card. It's a list, published in your DNS, of the servers allowed to send email for your domain. When an email arrives, the inbox checks: is this server on the list?
DKIM is your signature. Each email is signed with a private key, and the inbox checks that signature against a public key in your DNS. If anyone tampers with the message, the signature breaks.
DMARC is the rulebook. It tells inboxes what to do when an email fails SPF and DKIM — let it through, send it to spam, or reject it — and sends you reports about who's sending as you.
Why you need all three, not one
SPF alone breaks when email is forwarded. DKIM alone doesn't tell inboxes what to do about failures. Neither one protects the visible “From” address your customers actually see — only DMARC ties them to it.
Together, they make your email verifiably yours.
A worked example: a WooCommerce store sending from three platforms
Take a store that sends order emails from WooCommerce via an SMTP plugin, newsletters from Klaviyo, and support replies from Google Workspace. That's three different senders — each needs to be included in SPF and each needs its own DKIM key.
Miss one, and when DMARC enforcement goes live, that sender's email gets rejected. That's why we inventory every sender during monitoring mode before tightening anything.
The one mistake that breaks SPF
SPF has a hard limit: no more than 10 DNS lookups. Every “include:” for a new tool adds lookups, and many stores quietly blow past the limit as they add apps. When that happens, SPF fails for every email — silently.
Fixing it means consolidating includes, removing tools you no longer use, and sometimes flattening records. It's one of the first things we check in every audit.