Email Authentication Explained: SPF, DKIM and DMARC – Complete Guide for 2026

• Email spoofing is the primary vector for phishing attacks, costing businesses over 3 € billion in 2025 (FBI IC3 data). SPF, DKIM, and DMARC are the three protocols that prevent attackers from impersonating your domain.
• SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. It is the first line of defence but only covers the envelope sender (Return-Path), not the header “From” address.
• DKIM (DomainKeys Identified Mail) adds a cryptographic digital signature to each email, allowing recipients to verify that the message has not been tampered with in transit and that it genuinely came from your domain.
• DMARC (Domain‑based Message Authentication, Reporting & Conformance) connects SPF and DKIM, telling receiving servers what to do when an email fails authentication-monitor, quarantine, or reject. It also provides reporting on who is sending email using your domain.
• Only 10.7% of domains globally have DMARC enforcement (p=quarantine or p=reject), leaving the vast majority vulnerable to impersonation attacks. Major mailbox providers now reject non‑compliant messages at SMTP level.

• Envelope sender (Return‑Path): The address used by mail servers during delivery. SPF checks this.
• Header “From”: The address users see in their email client. DMARC checks alignment with this.

Attacker → SMTP server → email with spoofed From: yourdomain.com

• The header “From” address (the one users see)
• SPF does not prevent display name spoofing
• SPF breaks with email forwarding

v=spf1 ip4:192.0.2.0/24 include:_spf.google.com ~all

• 10 DNS lookup limit – exceeding this causes permanent SPF failure
• Only checks the envelope sender, not the header From
• Breaks with email forwarding – forwarding breaks SPF because the Return‑Path changes

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;
 s=selector1; t=1690000000; bh=...; h=from:to:subject;
 b=...

• Proves message integrity – confirms the email was not tampered with in transit
• Works through forwarding – the signature travels with the email
• Strong cryptographic verification – uses public‑key cryptography

• SPF alignment: The domain in the Return‑Path must match the domain in the header From.
• DKIM alignment: The domain in the DKIM signature (d=) must match the domain in the header From.

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; pct=100

• Marketing campaign deliverability
• Transactional email reliability
• CRM and automation email workflows
• Third‑party sending tools (HubSpot, Salesforce, Mailchimp, etc.)

• Create SPF record listing all authorised sending sources
• Include all email marketing, transactional, and business email services
• Test with ~all first, then move to -all

• Generate DKIM key pair for each sending domain
• Publish public key in DNS
• Configure email servers to sign outgoing emails
• Test with multiple selectors for rotation

• Start with p=none to collect data
• Monitor aggregate reports for 30‑60 days
• Identify all legitimate sending sources
• Move to p=quarantine after verifying all legitimate sources are authenticated
• Move to p=reject after 90+ days of no issues
• Set pct=100 and configure sp=reject for subdomains

• Monitor DMARC reports monthly
• Rotate DKIM keys periodically
• Update SPF records when adding new sending services
• Review and update policies as your email infrastructure evolves

# Check SPF
dig TXT example.com | grep spf
# Check DKIM
dig TXT selector1._domainkey.example.com
# Check DMARC
dig TXT _dmarc.example.com

Authentication-Results: spf=pass smtp.mailfrom=example.com;
 dkim=pass header.d=example.com;
 dmarc=pass header.from=example.com

SPF: pass
DKIM: pass
DMARC: pass (header.from matches authenticated domain)

• DMARC enforcement (p=quarantine or p=reject)
• Verified logo (SVG format)
• Verified Mark Certificate (VMC) for some providers

default._bimi.example.com TXT
"v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

• Email authentication is no longer optional. Major mailbox providers (Google, Yahoo, Microsoft) enforce DMARC for bulk senders, rejecting non‑compliant messages at SMTP level.
• SPF, DKIM and DMARC work together as a system. SPF authorises sending IPs, DKIM provides cryptographic signing, and DMARC connects them with enforcement policies.
• Only 10.7% of domains have DMARC enforcement (p=reject or p=quarantine). The vast majority remain vulnerable to spoofing and impersonation attacks.
• Start with DMARC p=none to collect data. Monitor for 30‑60 days before moving to enforcement. Identify all legitimate sending sources first.
• Use p=reject for full protection. Once properly configured, DMARC p=reject blocks all unauthenticated emails, preventing spoofing entirely.
• BIMI builds on DMARC to display brand logos in supported email clients, adding visual trust signals for recipients.

• RFC 7208 – Sender Policy Framework (SPF)
• RFC 6376 – DomainKeys Identified Mail (DKIM)
• RFC 7489 – DMARC
• BIMI Specification