How does the absence of DKIM affect email deliverability when SPF is passing and DMARC is aligned?
Summary
What email marketers say9Marketer opinions
Email marketer from Email Geeks states that DKIM is important to improve deliverability.
Email marketer from SocketLabs shares that forwarded messages may not pass SPF. This increases the importance of ensuring DKIM is correctly setup, otherwise the email will fail all email security checks.
Email marketer from Mailjet shares that even with SPF and DMARC, DKIM provides an additional layer of security and sender authentication, which can improve deliverability. They explain that some ISPs might view emails without DKIM as less trustworthy, potentially affecting inbox placement.
Email marketer from ZeroBounce responds by saying that the lack of DKIM has a slight affect if SPF passes, however, it would always be recommended to have both setup correctly to ensure messages pass all security checks.
Email marketer from Sendinblue responds that while SPF and DMARC are important, DKIM provides message integrity verification. If DKIM is missing, it reduces the overall authentication strength, and some email providers might be more likely to filter the message as spam, even with passing SPF/DMARC.
Email marketer from Reddit says that although SPF and DMARC are important, DKIM is increasingly important. The lack of DKIM when SPF is passing will not hurt as much as if SPF was failing - however it might impact long term deliverability.
Email marketer from Email Geeks explains that you can look in the headers for a DKIM signature in Gmail by using "Show Original".
Email marketer from Postmark shares that without DKIM, the sender's reputation might be negatively impacted even if SPF and DMARC pass. They explain that DKIM is an industry standard and is often expected, so its absence can raise red flags with some mailbox providers.
Email marketer from SparkPost explains that while DMARC can function with only SPF, using DKIM in conjunction provides a stronger authentication signal. They share that without DKIM, DMARC compliance might be more fragile, especially with forwarded emails. Having both makes the sender's authentication more robust.
What the experts say3Expert opinions
Expert from Spam Resource (summarising M3AAWG documentation) explains that DKIM signing all outbound email is a best practice even with SPF and DMARC as it provides an additional layer of authentication and helps ensure message integrity throughout the delivery chain.
Expert from Email Geeks explains that if SPF is passing and DMARC aligned, lack of DKIM won’t have any effect on deliverability in the common case, however it is worth looking at adding to make reputation and DMARC more robust against forwarding.
Expert from Word to the Wise shares that while SPF and DMARC can improve deliverability, implementing DKIM would improve overall security. This includes forwarded messages which might not pass SPF checks.
What the documentation says4Technical articles
Documentation from Microsoft explains that even if the email passes SPF and DMARC checks it still requires the use of DKIM for better email deliverability. They suggest it can still impact your deliverability if you don't implement DKIM.
Documentation from ietf.org explains that DKIM provides a method for verifying the source and integrity of email messages, allowing recipients to confirm that the message was sent by an authorized domain and has not been altered in transit. While not explicitly stating the impact without it when SPF/DMARC are present, it highlights DKIM's core function in authentication.
Documentation from AuthSMTP explains that while SPF can authenticate the sending server, DKIM provides message integrity verification. It explains the absence of DKIM, even with SPF passing, makes the email more susceptible to tampering and reduces trust, possibly affecting deliverability.
Documentation from DMARC.org explains that DMARC relies on SPF and DKIM to authenticate email. While DMARC can function if only one of SPF or DKIM passes, it strongly recommends both for robust authentication. Absence of DKIM (even with SPF passing) reduces the level of authentication, potentially impacting deliverability and increasing vulnerability to certain attacks.