4.5d email security spf dkim dmarc

Email spoofing

Forging the "from" address on an email so it appears to originate from someone other than the actual sender.

Mail gateway

The device or service that receives inbound email, checks its legitimacy, and decides whether to deliver, discard, or route it to spam.

Mail gateway placement

On-premises mail gateways sit in a screened subnet, since they must communicate with external mail servers on the internet.

Cloud-based mail gateway

Third-party services can provide mail gateway functionality instead of hosting it on-premises.

SPF (Sender Policy Framework)

DNS TXT record listing which mail servers are authorized to send email on behalf of a domain. Checks the sending server's identity.

DKIM (DomainKeys Identified Mail)

DNS TXT record holding a public key used to validate a digital signature applied to outgoing mail during transport between mail servers. Checks message integrity.

DKIM signature scope

The digital signature is added between mail servers during transport, not visible in the message body; found in the email headers.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DNS TXT record extending SPF and DKIM, specifying what a receiving server should do when a message fails validation: accept, quarantine, or reject.

DMARC does not check anything itself

DMARC relies purely on SPF and DKIM results; it only defines the policy action to take and provides reporting, it performs no independent validation.

DMARC reporting

Domain owners receive compliance reports showing how many messages validated successfully vs failed, helping detect spoofing of their domain.

SPF vs DKIM

SPF checks whether the sending server is authorized. DKIM checks whether the message was tampered with, via cryptographic signature. They are independent checks.