SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name

A plain-language guide to SPF, DKIM and DMARC: what each one does, how to roll out DMARC enforcement safely, and what e-mail authentication cannot stop.

E-mail was designed in an era of trust. The basic protocol lets any sending server put any address in the “From” line, which is why criminals can send messages that appear to come from your domain. Three DNS-based standards, SPF, DKIM and DMARC, let receiving mail servers check whether a message really comes from you, and tell them what to do when it does not.

SPF: who is allowed to send

Sender Policy Framework is a TXT record in your domain’s DNS that lists the servers and services authorized to send mail for it. A simple record might look like v=spf1 include:_spf.example.net -all, meaning “mail from the listed provider is allowed; reject everything else”.

Two limitations are worth knowing. First, SPF checks the technical envelope sender (the Return-Path), not the visible From address the recipient sees. Second, SPF often fails when a message is forwarded, and the standard limits the number of DNS lookups a record may trigger, so long chains of includes can break it silently.

DKIM: a signature that proves integrity

DomainKeys Identified Mail adds a cryptographic signature to each outgoing message. Your mail platform signs with a private key, and you publish the matching public key in DNS under a “selector” name. The receiving server checks that the signature is valid, which proves that the message was authorized by the signing domain and was not altered in transit. DKIM usually survives forwarding better than SPF. Every service that sends on your behalf, from your marketing platform to your helpdesk, should sign with your domain.

DMARC: tying it to the address people see

DMARC is what turns SPF and DKIM into brand protection. It adds the concept of alignment: for a message to pass, the domain in the visible From address must match the domain validated by SPF or DKIM. It also lets you publish a policy, in a TXT record at _dmarc.example.com, that tells receivers what to do with mail that fails:

• p=none: take no action, just send reports. Used for monitoring.
• p=quarantine: treat failing mail as suspicious, typically delivering it to spam.
• p=reject: refuse failing mail outright.

DMARC also provides aggregate reports, sent to the address in the rua tag, showing which sources are sending mail using your domain and whether it passes. These reports are the foundation of a safe rollout. Major mailbox providers have also tightened their requirements in recent years, expecting bulk senders to have SPF, DKIM and a DMARC record in place.

A safe rollout plan

1. Inventory every sender. Corporate mail, marketing and newsletter tools, CRM, billing, HR and payroll systems, support desks. Forgotten senders are the main cause of problems.
2. Publish DMARC at p=none with reporting enabled, and review the reports for several weeks.
3. Fix authentication for each legitimate source: add it to SPF where appropriate and enable DKIM signing with your domain.
4. Move to p=quarantine, optionally applying it to a percentage of mail first, and watch for legitimate mail being affected.
5. Move to p=reject once your legitimate traffic passes consistently. Keep monitoring reports, because new tools get added over time.

Do not forget domains that never send mail. Parked and defensive domains can be locked down with an SPF record that authorizes nothing (v=spf1 -all) and a DMARC policy of reject, so they cannot be abused for spoofing.

What DMARC does not do

DMARC protects your exact domain. It does not stop attackers from sending mail from a lookalike domain such as examp1e.com, which they control and can authenticate perfectly. It does not stop display-name tricks, where the sender’s name says your brand but the address is unrelated, and it does not help when a real mailbox is compromised. That is why e-mail authentication works best together with lookalike domain monitoring and fast takedowns of the domains and pages used in campaigns.

Close the remaining gaps

Once your own domain is locked down, attackers move to domains that only look like yours. Phishvoid finds those lookalikes, including ones set up with mail records, and gets them suspended through registrars, hosts and blocklists. Book a free exposure scan to see which lookalike domains are ready to send mail in your name, or report a phishing site.