SPF, DKIM & DMARC Explained – Email Security Guide
SPF, DKIM and DMARC are important technologies used to reduce certain forms of email spoofing and domain impersonation. Each control performs a different function and they work best when deployed together.
Email authentication improves domain protection, but a message can still be malicious even when authentication checks pass.
What problem does email authentication address?
Email was not originally designed with strong sender authentication built into every message.
Attackers can exploit this flexibility to make messages appear to come from domains they do not control.
1. SPF
SPF allows a domain owner to publish which mail systems are authorized to send email on behalf of the domain.
Receiving systems can compare the sending server with the domain's published SPF policy.
2. DKIM
DKIM adds a cryptographic signature to email messages.
Receiving systems can use a public key published in DNS to verify that the signed portions of the message were not modified after signing.
3. DMARC
DMARC builds on SPF and DKIM and adds alignment rules and a published policy.
It can tell receiving systems how the domain owner would like messages handled when authentication requirements are not met.
4. Alignment matters
DMARC checks whether the authenticated domains align with the domain shown to the user in the visible From address.
This helps reduce some forms of direct domain impersonation.
5. Authentication does not prove message safety
Attackers can send malicious messages from domains they legitimately control, and compromised legitimate accounts can also send harmful email.
Email authentication should therefore be considered alongside sender context, links, attachments and message behavior.
Review publicly observable email-domain configuration including SPF and DMARC indicators.
How SPF, DKIM and DMARC work together
SPF identifies servers permitted to send email for a domain. DKIM adds a signed identifier that can be checked after delivery. DMARC tells receiving systems how to align and use these signals when a message claims to come from a domain.
These controls reduce impersonation risk, but they are not a complete anti-phishing solution. Strong email security also needs secure accounts, user awareness, monitoring and a process for investigating suspicious messages.
- Publish and validate SPF for legitimate sending services.
- Enable DKIM signing in each mail platform.
- Start DMARC in monitoring mode and review legitimate traffic.
- Increase enforcement only after legitimate senders are correctly configured.
Why a legitimate message can fail
A newsletter, support system or cloud service can fail alignment when it sends for an organisation without correct SPF or DKIM configuration. The correct response is to configure that sender—not weaken authentication controls for all mail.
Related ROSVIX tools
Use these tools when you want to investigate the technical signals discussed in this guide.
SPF, DKIM and DMARC in simple terms
- SPF identifies authorized sending systems.
- DKIM cryptographically signs messages.
- DMARC combines authentication and policy.
- Alignment connects authentication to the visible From domain.
- Passing authentication does not guarantee message safety.
- Email security decisions should consider multiple signals.