Direct answer

The visible From domain is what the reader sees. SPF evaluates an SMTP identity such as MAIL FROM, while DKIM identifies a signing domain in d=. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain. The distinction matters because similar-looking labels can describe different identities, sources, and observation windows. The intended outcome is straightforward: Understand the three common domain identities used in SPF, DKIM, and DMARC decisions.

Before acting, write down the exact identifier, message, provider, and UTC observation time involved. That small evidence boundary prevents a general domain assumption from replacing the result of the actual check. It also gives the next reviewer enough context to repeat the work without seeing unrelated recipient data or credentials.

Prepare the evidence

Use information you are authorized to inspect. Preserve exact protocol values such as domains, selectors, IP addresses, tags, and response classes, but redact local parts, API keys, cookies, mailbox credentials, and unrelated content before sharing. Name the source of each observation and keep unavailable sources outside any passing or not-listed total.

The preparation should answer four questions: what was tested, which system made the observation, when it was observed, and what the observation cannot prove. If any answer is missing, record the gap instead of filling it with a guess.

Work through the method

  1. Read the visible From address from the message header.
  2. Read smtp.mailfrom or the equivalent trusted Authentication-Results property for SPF.
  3. Read d= and s= from each DKIM-Signature field.
  4. Compare organizational or strict alignment according to the published DMARC policy.

Keep each step reversible. When the method calls for a change, record the previous value, owner, intended effect, and rollback condition. Send or query again only after the change is in effect, and use a fresh message or logical run when the evidence belongs to a new event.

Worked example

From uses example.com, SPF passes for bounce.vendor.example, and DKIM passes with d=example.com. DKIM can provide aligned authentication even though the SPF identity differs.

Write the example as an identity-and-evidence table when several domains or providers are involved. A reader should be able to point to the field supporting each conclusion. If the evidence supports several explanations, list those explanations and the next observation that would distinguish them.

Interpret the result

Separate a protocol fact from a product status and from an operational recommendation. A record can be present while a message fails; a server can accept a message without placing it in the inbox; and a source can be unavailable without returning a clean result. Preserve complete, partial, unknown, unavailable, and failed outcomes as different states.

Use the result to choose one next check. Repeating an unrelated checker or changing several DNS records at the same time usually reduces the value of the evidence. Where a plan allowance applies, retries with the same logical submission should follow the documented idempotency behavior rather than creating duplicate work.

Limits and failure cases

A simplified identity table does not replace full receiver processing, organizational-domain discovery, or signature verification. Results also age: DNS, keys, provider policies, list entries, message paths, and account configuration can change after the observation. Do not turn this bounded evidence into a guarantee of future delivery, mailbox ownership, universal reputation, or logo display.

An empty, timed-out, or unsupported observation should remain unknown or unavailable. It should never be rewritten as pass, valid, or not listed merely to make a report look complete.

Next useful action

Use a received message to identify the exact domain and selector before opening a checker. Retain the report identifier and the smallest redacted evidence needed for comparison. If the result changes a published instruction, create a reviewed content revision and flag dependent translations instead of silently rewriting them.

Primary references for review

These links support the technical review of this draft. Their presence is not a claim that an accountable reviewer has approved every sentence, provider behavior, or localized version.