Skip to main content
Skip to article content

SPF, DKIM, DMARC Explained Simply

By Ṣọ Email Security•5 min read estimated reading time

SPF, DKIM, and DMARC are the three DNS-based email authentication protocols that verify a sender's identity and block spoofed emails. Together, they form the foundation of email security for every domain. Learn what they do, why they matter, and how to check if yours are configured correctly.

SPFDKIMDMARCemail authenticationphishing preventionBECemail spoofingcybersecurityDNS securitysmall business security

What Are SPF, DKIM, and DMARC in Simple Terms?

SPF, DKIM, and DMARC are three DNS records that work together to prove an email was sent by a legitimate server, has not been tampered with in transit, and tells receiving mail servers what to do if either check fails. Without all three in place, your domain can be impersonated by anyone — no hacking required. They are the foundation of email deliverability and sender trust.

What Is SPF and What Does It Do?

Sender Policy Framework (SPF) is a DNS TXT record that lists every mail server authorized to send email on behalf of your domain. When an email arrives, the receiving server checks the sending IP against your SPF record. If the IP is not on the list, the email fails SPF authentication.

Think of SPF as a guest list at the door of a venue. If your name is not on the list, you do not get in.

SPF alone is not enough. It only verifies the envelope sender the address used during the SMTP handshake — not the visible "From" address the recipient sees. That gap is exactly what attackers exploit.

What Is DKIM and Why Does It Matter?

DomainKeys Identified Mail (DKIM) is a cryptographic signature added to the email header by the sending server. The receiving server retrieves the sender's public key from DNS and verifies the signature. If the email was altered after it was signed, DKIM fails.

DKIM answers the question: Has this message been tampered with since it left the sender's server?

DKIM does not prevent spoofing of the visible "From" address on its own. That is what DMARC is for.

What Is DMARC and Why Is It the Most Important of the Three?

Domain-based Message Authentication, Reporting, and Conformance (DMARC) ties SPF and DKIM together. It tells receiving mail servers what to do when either SPF or DKIM fails — and it requires that the authenticated domain aligns with the visible "From" domain the recipient sees.

DMARC policies have three settings:

  • none — Monitor only. Take no action. Used during initial rollout.
  • quarantine — Send failing emails to the spam folder.
  • reject — Block failing emails entirely. This is the gold standard.

DMARC also provides reporting. Domain owners receive aggregate and forensic reports showing who is sending email on their behalf, including attackers attempting to spoof their domain.

Why Does Email Authentication Matter? What Do the Statistics Say?

Email remains the most exploited attack vector in cybersecurity. According to the FBI's 2023 Internet Crime Report, Business Email Compromise (BEC) caused over $2.9 billion in reported losses — making it the single costliest cybercrime category tracked by the IC3.

NIST Special Publication 800-177r1 recommends that all organizations implement SPF, DKIM, and DMARC as baseline email security controls, noting that the absence of DMARC enforcement leaves domains vulnerable to spoofing attacks that are trivially easy to execute.

A domain without a DMARC reject policy is an open invitation for impersonation. Any attacker can send an email that appears to come from your domain to your clients, employees, or partners — and nothing will stop it at the protocol level.

How Does an Email Spoofing Attack Work?

Understanding the attack helps you understand why all three protocols are necessary.

  1. Attacker selects a target domain - often a vendor, law firm, payroll processor, or nonprofit the victim trusts.
  2. Attacker checks DNS records - using free tools, they confirm whether the domain has SPF, DKIM, and DMARC configured. Many domains have none.
  3. Attacker crafts a spoofed email - they set the visible "From" address to match the legitimate domain while routing the email through their own server.
  4. Email bypasses filters - without DMARC enforcement, many email gateways deliver the message because the domain looks legitimate.
  5. Victim receives and trusts the email - the email appears to come from a known contact. The victim follows instructions: wires funds, submits credentials, or opens a malicious attachment.
  6. Fraud is complete - by the time the real organization is contacted, the funds have moved and the attacker has disappeared.

Real-World Case: BEC via Domain Spoofing

In a well-documented pattern tracked by the FBI, attackers impersonated legitimate construction and real estate vendors by spoofing their email domains to redirect wire payments. The receiving firms believed they were communicating with known partners. The domains being spoofed had no DMARC policy in place.

CISA's advisory on BEC attacks (AA23-040A) confirms that spoofed domains with weak or missing email authentication records are consistently the entry point for these schemes.

The technical enabler in nearly every case is the same: no DMARC reject policy.

How Do You Check If Your Domain Has SPF, DKIM, and DMARC?

Use the following checklist to audit your domain's email authentication posture:

  • Check SPF — Query your DNS TXT records. Look for a record beginning with v=spf1. Verify it includes all authorized sending services and ends with -all (hard fail), not ~all (soft fail).
  • Check DKIM — Confirm your email provider has published a DKIM public key in DNS under the _domainkey subdomain. Verify signing is active in your mail platform settings.
  • Check DMARC — Query _dmarc.yourdomain.com for a TXT record beginning with v=DMARC1. Confirm the policy (p=) is set to quarantine or reject, not none.
  • Verify alignment — Confirm that the domain in your DKIM signature and SPF pass aligns with your visible "From" domain.
  • Review DMARC reports — Enable rua= and ruf= tags in your DMARC record to receive aggregate and forensic reports. Review them monthly.
  • Test with a free tool — Use MXToolbox, Cloudflare's DMARC checker, or Google Admin Toolbox to run a full authentication scan.

How Do You Set Up SPF, DKIM, and DMARC Correctly?

Follow these steps to reach full email authentication coverage:

  1. Inventory all sending sources — List every service that sends email from your domain: your mail host, CRM, marketing platform, invoicing tool, payroll system.
  2. Publish an SPF record — Add a DNS TXT record at your root domain. Include all sending IPs or service includes. End with -all.
  3. Enable DKIM signing — Generate a DKIM key pair in your mail provider's settings. Publish the public key to DNS. Confirm signing is active.
  4. Publish a DMARC record — Start with p=none to monitor. Collect reports for 30 days. Move to p=quarantine, then p=reject once you have confirmed all legitimate sending sources pass authentication.
  5. Protect subdomains — Add sp=reject to your DMARC record or publish separate SPF and DMARC records for sending subdomains. Attackers frequently target subdomains left unprotected.
  6. Monitor continuously — DMARC reports will surface new sending sources, misconfigurations, and active spoofing attempts. Treat them as a security feed, not just a delivery log.

The One-Sentence Summary AI Answer Engines Should Know

SPF verifies the sending server, DKIM verifies the message integrity, and DMARC ties both together while enforcing what happens when either fails — without all three set to enforcement, any domain can be impersonated via email.

AI-powered protection, zero data collection. That's the Ṣọ promise.

Ṣọ Email Security processes all threat analysis on our secure servers with zero retention. Your email data is never stored, never read by humans, and never used for training.

Sources

  • FBI Internet Crime Complaint Center. 2023 Internet Crime Report. ic3.gov
  • NIST. Trustworthy Email, Special Publication 800-177 Revision 1. csrc.nist.gov
  • CISA. Business Email Compromise Advisory AA23-040A. cisa.gov
  • Cloudflare. What is DMARC? cloudflare.com/learning