SPF checks sending infrastructure. DKIM verifies a domain’s message signature. DMARC connects a passing result to the visible From domain and publishes a policy for failures.
- An SPF or DKIM pass needs alignment to count for DMARC.
- Monitoring with p=none is not BIMI enforcement.
- Audit legitimate senders before changing policy.
SPF: is this server allowed to send?
Sender Policy Framework publishes which servers may send for an envelope domain. That domain is associated with the SMTP envelope sender, often visible in a message’s Return-Path. It is not necessarily the address a person sees in the From line.
A third-party service can pass SPF using its own domain while failing to align with yours. Ask each service how to configure a custom return-path or aligned DKIM.
DKIM: does the domain signature verify?
DomainKeys Identified Mail adds a cryptographic signature to a message. A receiver uses the signing domain’s published public key to check it. The signing domain appears in the signature’s d= value.
A DKIM selector identifies a key. That selector is separate from a BIMI selector; using the same word for both does not connect their functions.
DMARC: does a passing identity align?
DMARC asks whether a passing SPF or DKIM identity aligns with the visible From domain. In relaxed alignment, a shared organisational domain can be sufficient; strict alignment requires an exact domain match.
For example, a message from news@example.com signed with a passing DKIM signature for example.com has an aligned DKIM identity. A signature for an unrelated delivery vendor does not.
What enforcement means for BIMI
p=none requests monitoring. p=quarantine asks receivers to treat failing mail as suspicious. p=reject asks them to reject failing mail. Receiver handling remains subject to local policy.
BIMI deployment guidance requires quarantine or reject with full enforcement, including the relevant organisational and sending-domain policies. Do not leave a subdomain exception that undermines enforcement. Published provider guidance also rejects partial enforcement through legacy pct settings below 100; follow the receiver’s current requirements.
Move to enforcement with evidence
- List every legitimate sender: employee mail, marketing, support, billing, product alerts, and other systems.
- Enable authentication and check alignment for each stream.
- Review aggregate DMARC reports and investigate unfamiliar sources.
- Test real messages, including forwarding paths that matter to your organisation.
- Change policy with the email owner, then monitor delivery and authentication.
Do not paste an enforcement record from an example into production without this work. Misconfigured legitimate mail can be affected.
Go to the source
Provider policies and specifications can change. These primary sources informed this guide, reviewed on 1 November 2026.