Email remains the primary attack surface for corporate espionage, wire fraud, and spear-phishing campaigns. Because the original Simple Mail Transfer Protocol (SMTP) specified no built-in sender verification mechanism, anyone can send an email claiming to originate from ceo@yourcompany.com. The global standard defense against domain spoofing relies on three symbiotic protocols: SPF, DKIM, and DMARC.
1. The Email Authentication Triad Explained
A. Sender Policy Framework (SPF)
SPF (RFC 7208) allows a domain owner to publish a public TXT record listing all IP addresses, subnets, and third-party SaaS services authorized to send email on their behalf.
v=spf1 ip4:192.0.2.0/24 include:_spf.google.com include:sendgrid.net -allv=spf1— Identifies the DNS record as SPF version 1.ip4 / ip6— Explicit IP subnets allowed to send mail.include:— Inherits authorized sending IPs from third-party services (e.g. Google Workspace, SendGrid).-all— Hard fail mechanism instructing receivers to reject unauthorized IPs.
Critical Limitation of SPF: SPF only validates theReturn-Path(Envelope From) address, NOT the visibleFrom:address displayed to human readers in inbox clients. This gap is why SPF alone cannot stop spoofing!
B. DomainKeys Identified Mail (DKIM)
DKIM (RFC 6376) adds a cryptographic signature to outbound messages. The sending mail server calculates an asymmetric SHA-256 hash across specific email headers and body content, signing it with a private key. The receiving server looks up the domain's public key in DNS using a specified selector and verifies the cryptographic signature.
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3...C. Domain-based Message Authentication, Reporting, and Conformance (DMARC)
DMARC (RFC 7489) bridges the gap between SPF and DKIM. It binds the visible From: header address to the authenticated domain under SPF and/or DKIM through a concept known as Identifier Alignment. Furthermore, DMARC specifies what action receiving mail servers should take when alignment fails.
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100; adkim=s; aspf=s2. Understanding DMARC Identifier Alignment
For DMARC to pass, at least one of the following alignment checks must succeed:
| Protocol | Header Checked | Relaxed Alignment (aspf=r) | Strict Alignment (aspf=s) |
|---|---|---|---|
| SPF Alignment | Return-Path vs From: | Subdomains match root domain (mail.example.com aligns with example.com) | Exact match required (example.com = example.com) |
| DKIM Alignment | d= domain in DKIM signature vs From: | Subdomains match root domain | Exact match required |
3. DMARC Enforcement Roadmap: From p=none to p=reject
- Phase 1 — Monitoring Mode (
p=none): Publish a DMARC record withp=noneand a designated aggregate report address (rua). Monitor aggregate XML reports for 2 to 4 weeks to discover all legitimate third-party sending services across your organization. - Phase 2 — Quarantine Policy (
p=quarantine): Transition top=quarantine. Unauthenticated emails failing DMARC alignment will be automatically routed to receivers' Spam/Junk folders rather than inbox. - Phase 3 — Maximum Enforcement (
p=reject): Setp=rejectwithpct=100. Receiving mail servers will outright block and drop unauthorized spoof emails before they reach end users.
4. How to Test Your Domain Setup Free with IncogSay
IncogSay provides dedicated email trust inspection tools that perform deep DNS recursive queries, syntax checks, and alignment evaluations:
- SPF Shield & Record Checker — Validates SPF syntax, counts DNS lookup depth (must be ≤ 10), and verifies IP authorization.
- DKIM Crypto Lookup — Queries public DKIM selectors and verifies key lengths.
- DMARC Policy Enforcer — Inspects policy enforcement levels, aggregate reporting destinations, and alignment rules.
- Email Security Score — Generates a consolidated 0–100 security rating for your domain's email defense posture.