CyberStack

Knowledge / identity hardening acsc-glossary

DMARC, DKIM, and SPF

Three DNS records. Receivers use them together so your domain is harder to wear.

SPF, DKIM and DMARCSPF lists who may send. DKIM signs the message. DMARC is the policy when those fail to align with the visible From domain.SPFSPFwho may sendDKIMDKIMsigned by the domainDMARCDMARCwhat to do on failSPF SAYS WHO MAY SEND. DKIM SIGNS. DMARC IS THE POLICY.Alignment is the point. A signature nobody is required to honour is not a policy.p=none forever is observation. Policy is quarantine or reject.

SPF (Sender Policy Framework)

A TXT record listing which mail servers may send as your domain. The receiver checks the sending IP against that list. SPF does not sign the message.

DKIM (DomainKeys Identified Mail)

A cryptographic signature on the message, checked with a public key in DNS. If the signed bits were altered in transit, the check fails.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

The policy for when SPF or DKIM fail, and a mailbox for reports. Alignment is the point: the domain the person sees has to match what passed.

BIMI (Brand Indicators for Message Identification) is a later, optional logo in supporting inboxes. It needs a working DMARC policy. It is not a fourth authentication check.

SPF, DKIM, and DMARC work together. p=none is watch, not policy. Quarantine or reject is when you mean it. This cuts cheap use of your domain. It does not stop a lookalike name or a mailbox that was taken over.

Fact source: ASD's ACSC glossary.