How SPF, DKIM and DMARC Help Prevent Email Spoofing
Summary
An explainer shows how email spoofing exploits the gap between envelope and visible sender addresses, what SPF and DKIM verify, and how DMARC alignment and policy affect unauthenticated messages.
Key points
- Email’s envelope sender can differ from the From address displayed to recipients, enabling spoofing.
- SPF checks whether the sending server is authorized for the envelope sender’s domain; it does not by itself authenticate the visible From address.
- DKIM verifies a domain’s signature and whether signed content was altered, but the signing domain may not match the visible sender.
- DMARC requires SPF or DKIM to align with the visible From domain and specifies how receivers should handle failures.
- The article demonstrates using DNS TXT queries to inspect a domain’s SPF and DMARC records.
- A DMARC policy of none monitors, quarantine sends failing messages to spam, and reject instructs receivers not to deliver them.
Article Details
- Topic
- How SPF, DKIM, and DMARC work together to prevent email spoofing
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | evil[.]com | Illustrative attacker-owned domain used to send spoofed email with valid SPF and DKIM authentication. |
attacker@evil[.]com | Illustrative envelope sender address used in the email-spoofing example. |