Email was never designed with authentication in mind — by default, anyone can put any "From" address on an outgoing message. SPF, DKIM and DMARC are three separate DNS-based mechanisms that, together, let a domain owner tell the world's mail servers how to tell a genuine email from that domain apart from a forged one.
SPF (Sender Policy Framework)
An SPF record is a TXT record listing which mail servers are authorized to send email on behalf of your domain. A receiving mail server checks the sending server's IP against this list; if it's not there, the SPF check fails.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to outgoing mail, verified against a public key published in DNS. Unlike SPF, DKIM survives being forwarded through another server, since the signature travels with the message itself rather than depending on which IP delivered it.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties the other two together. It publishes a policy — what should happen if a message fails both SPF and DKIM alignment (`p=none` just monitor, `p=quarantine` send to spam, `p=reject` block outright) — and, importantly, gives you a channel (via the `rua` reporting address) to actually see who is sending mail claiming to be from your domain, including legitimate services you may have forgotten to authorize.
Why all three, not just one
SPF alone breaks under forwarding. DKIM alone doesn't tell receivers what to do about a failure. DMARC needs at least one of the other two to actually have something to check alignment against. Together, they cover each other's gaps.
How to check a domain's setup
Check each individually with our SPF Checker, DKIM Checker (a selector is required — check your mail provider's documentation for it), and DMARC Checker, or get a combined view with Email Security Checker.