SPF, DKIM, DMARC Explained: Stopping Email Spoofing

Three acronyms, one goal: stopping someone else from sending email that looks like it came from your domain. Here's what each one actually does.

SPF: who's allowed to send for your domain

SPF (Sender Policy Framework) is a DNS record listing which mail servers are authorised to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks whether it came from a server on that approved list.

DKIM: proving the message wasn't altered

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing email, generated using a private key only your mail system holds. The receiving server checks that signature against a public key published in your DNS, confirming the message genuinely came from your systems and wasn't altered in transit.

DMARC: telling receivers what to do when checks fail

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving servers what to do when a message fails those checks - quarantine it, reject it outright, or just monitor and report. Without DMARC, a message that fails SPF or DKIM might still land in someone's inbox, because there's no instruction telling the receiving server to do otherwise.

Why all three need to work together

A domain with only SPF, only DKIM, or no DMARC enforcement is still spoofable in practice. All three configured and monitored together close the gap that lets attackers send convincing impersonation emails from what looks like your own domain. Our cloud and workspace security service configures and monitors all three as part of a broader email and tenant hardening program.