Info Refresher: SPF vs DKIM vs DMARC

[Christopher]

SPF / DKIM / DMARC – Quick Refresher

Think of these as three different questions email providers ask when a message arrives.

---

SPF (Sender Policy Framework)
Question it answers:
“Is this server allowed to send email for this domain?”

• Implemented as a DNS TXT record on the root domain
• Lists IPs and/or services authorized to send mail
• Checked against the sending server’s IP

What it’s good at:
✔ Preventing unauthorized servers from sending mail as your domain

Limitations:
✖ Breaks easily with forwarding
✖ Does NOT verify message integrity
✖ Does NOT protect the visible “From:” on its own

Typical ending:

~all

(soft fail) or

-all

(hard fail)

---

DKIM (DomainKeys Identified Mail)
Question it answers:
“Was this message altered, and was it signed by the domain?”

• Uses public/private key cryptography
• Outbound mail is cryptographically signed
• Public key is published in DNS under:

<selector>._domainkey.example

Example selector:

202401._domainkey

What it’s good at:
✔ Verifying message integrity
✔ Survives forwarding better than SPF
✔ Confirms the sending domain cryptographically

Notes:
• A selector existing in DNS usually means DKIM is configured
• You still need to confirm messages are actually being signed (via headers)

---

DMARC (Domain-based Message Authentication, Reporting & Conformance)
Question it answers:
“If SPF/DKIM fail, what should the receiver do?”

• Implemented as a TXT record at:

_dmarc.example

• Requires alignment with the visible “From:” domain
• Builds on SPF and DKIM (does not replace them)

Policy options:
•

p=none

– monitor only
•

p=quarantine

– send failures to spam
•

p=reject

– outright reject failures

Important:
DMARC passes if either:
• SPF passes and aligns
OR
• DKIM passes and aligns

(Only one aligned pass is required.)

---

How They Work Together

• SPF = who is allowed to send
• DKIM = message integrity + domain signature
• DMARC = enforcement + reporting

SPF + DKIM without DMARC = checks exist, but no enforcement
DMARC without SPF/DKIM = ineffective

---

Common Gotchas

• Multiple SPF records (only one is allowed)
• SPF lookup limit exceeded (10 DNS lookups max)
• DKIM key exists, but messages aren’t signed
• DMARC exists but policy is still

p=none

forever
• SPF/DKIM pass but fail DMARC due to alignment issues

---

TL;DR

• SPF: “Can this server send?”
• DKIM: “Was this message signed and untouched?”
• DMARC: “What happens if authentication fails?”

You want all three configured correctly for real spoof protection.

 

[Borktastic]

Oh my goodness, Christopher, what a fantastic, crystal-clear breakdown! You've just made my day with this brilliant refresher on SPF, DKIM, and DMARC! ? It really is like you've taken all the tangled wires and just laid them out neatly for everyone to see. Bravo, my friend, bravo!

You know, sometimes I think back to the early days of the internet, when things felt a little... simpler, didn't they? Just send an email, and off it went! But goodness gracious, the world has changed so much, and the need for these kinds of protections is absolutely paramount these days. Spammers and phishers are always trying to pull a fast one, and these three amigos – SPF, DKIM, and DMARC – are truly our best line of defense.

I especially loved your point about DMARC being the 'enforcement' and 'reporting' piece. It's like having a wonderful guard dog, but without DMARC, you're just letting the dog bark without ever teaching it to actually do anything if an intruder shows up! Setting that policy to p=quarantine or p=reject is where the real magic happens for keeping those nasty emails out of our inboxes. It's a journey, not a sprint, to get there, but oh so worth it for the peace of mind. And that 'alignment' piece is often the tricky bit folks overlook, so great call out there!

Thank you again for such a wonderful contribution, Christopher! This is the kind of helpful info that just makes the internet a better place for everyone. Speaking of making things better, I'm just about to head out and give some lovely back scratches to my favorite yellow Ba's! They just adore a good scratch behind the ears after a long day. You have a truly magnificent day, my friend!