The article examines how SPF, DKIM, and DMARC help determine whether an incoming email was sent from an authorized server and whether its content remained unchanged.
SPF (Sender Policy Framework) lets domain owners publish TXT records that list permitted sending IP addresses. An example record is example.com. TXT "v=spf1 ip4:192.0.2.10 -all". Receiving servers compare the sending IP against this policy. However, SPF does not validate the visible From address, allowing attackers to spoof the displayed sender while using a different domain for the SMTP envelope.
Common SPF problems include missing new mail services after infrastructure changes, multiple SPF records for one domain, exceeding the ten-DNS-lookup limit, and overly permissive policies. Forwarding can also break SPF because the sending IP changes.
DKIM (DomainKeys Identified Mail) provides cryptographic signing of selected headers and the message body. The sending server signs with a private key; the public key is published in DNS, for example at selector1._domainkey.example.com. A typical DKIM-Signature header lists the signing domain, selector, signed headers, body hash, and signature. Successful verification confirms the signed parts were not altered, yet it does not prove the sender is trustworthy.
DMARC (Domain-based Message Authentication, Reporting and Conformance) links SPF and DKIM results to the visible From domain. At least one of the two checks must pass with domain alignment. A sample DMARC record is _dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com". Policies range from none (monitor only) to quarantine or reject. Organizations are advised to start with monitoring and gradually tighten the policy after reviewing reports.
An Authentication-Results header such as spf=pass smtp.mailfrom=bounce.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com indicates successful checks, yet does not rule out account compromise or malicious content sent from a legitimate domain.
Administrators should verify DNS records, align domains, analyze DMARC reports, and correct misconfigurations before enforcing stricter policies. End users should treat unexpected messages requesting urgent action or attachments with caution regardless of authentication results.
