NewThe ManyPI MCP Server is now live
ManyPI
ManyPI
LoginSign up

Email authentication explained with SPF, DKIM and DMARC

How a receiving mail server decides whether a message really comes from the domain in its From line. Three DNS records, explained with examples and a short exercise, for IT and information systems classes.

Guide1 hBachelor +2CC BY 4.0

What you will learn

  • Explain why the From address of an email can be forged
  • Read an SPF, a DKIM and a DMARC record
  • Explain alignment and what a DMARC policy asks receivers to do
  • Find these records for a real domain

Before you start: A basic idea of what DNS does: it turns names into addresses and other records.

The problem

Email was designed without proof of sender. The From line is just text: anyone can write ceo@example.com there. Phishing relies on exactly that. Three records published in the sender's DNS let a receiving server check a message instead of trusting it.

SPF: which servers may send

SPF (Sender Policy Framework, RFC 7208) is a TXT record on the domain that lists the servers allowed to send its mail.

SPF record for example.com
example.com.  TXT  "v=spf1 include:_spf.mailprovider.example ip4:203.0.113.10 ~all"

  • include: adds the servers of a mail provider.

  • ip4: allows one address, here a company's own server.

  • ~all says: anything else is suspicious (soft fail). -all would say: reject it.

The check uses the envelope sender (the Return-Path), not the visible From line. SPF also allows at most 10 DNS lookups; a record with more breaks.

DKIM: a signature on the message

DKIM (DomainKeys Identified Mail, RFC 6376) signs each message. The sending server adds a DKIM-Signature header; the matching public key sits in DNS under a selector.

DKIM key under the selector "mail2026"
mail2026._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"

The signature names its domain (d=example.com) and selector (s=mail2026). If the message was changed on the way, the signature no longer verifies. Unlike SPF, DKIM survives forwarding.

DMARC: what to do when checks fail

DMARC (RFC 7489) ties the two to the visible From domain and tells receivers what the owner wants done with failures.

DMARC record for example.com
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

  • A message passes DMARC when SPF or DKIM passes and its domain matches (aligns with) the From domain.

  • p=none only asks for reports, p=quarantine asks to treat failures as spam, p=reject asks to refuse them.

  • rua= is where receivers send daily summary reports.

Since February 2024, Google requires SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to Gmail addresses (Google's sender guidelines).

Exercise

  1. Use the Mailbox Provider Checker to find who receives email for your school's or university's domain.

  2. Look up its SPF and DMARC records with any DNS lookup tool or nslookup -type=TXT _dmarc.yourdomain in a terminal.

  3. Answer: which policy does the domain publish? What would happen to a forged message with its name in the From line?

Key terms

  • Envelope sender: the address the sending servers use for bounces, checked by SPF.

  • Selector: the label that tells a receiver which DKIM key to fetch.

  • Alignment: the SPF or DKIM domain matches the From domain.

Reuse this material

CC BY 4.0

You may copy, adapt and share it, also commercially, as long as you credit ManyPI and link back.

"Email authentication explained with SPF, DKIM and DMARC" by ManyPI (https://manypi.com/edu/email-authentication-spf-dkim-dmarc), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

Related