Email was originally not designed with strong identity verification. As a result, an attacker can try to make a message appear as if it was sent from:

while the message was actually sent from a completely different server.

This is called email spoofing.

First, the simple answer

A simple analogy

Imagine your company is a building and only certain couriers are allowed to send packages on behalf of your company.

The actual technology is somewhat more complex, but this gives a good idea of how the three mechanisms complement each other.

1. What is SPF?

SPF stands for Sender Policy Framework.

Your organisation publishes in DNS which systems are authorised to send email on behalf of your domain.

Think for example of:

• Microsoft 365;
• a CRM system;
• a marketing platform;
• an accounting package;
• an online shop;
• a ticketing system;
• other legitimate mail platforms.

When a receiving mail server gets a message, it can check whether the sending infrastructure is authorised within the domain's SPF policy.

Why does SPF often fail?

Many organisations use more sending systems than they realise.

For example, Microsoft 365 may be correctly included, but in addition, the following also send:

• the website;
• the CRM;
• the invoicing package;
• the scanner;
• a newsletter platform;

emails on behalf of the same domain.

Can I create multiple SPF records?

In practice, there should be one valid SPF policy per domain.

If you have multiple sending platforms, they are combined within that policy.

2. What is DKIM?

DKIM stands for DomainKeys Identified Mail.

With DKIM, an outgoing email gets a cryptographic digital signature.

The sending mail server signs the message with a private key. The receiving mail server uses information published via DNS to verify that signature.

What is the advantage of DKIM?

DKIM makes it much harder to simply forge a convincing message on behalf of your domain.

Additionally, the recipient can verify whether important signed parts of the message have not been undesirably altered since signing.

3. What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance.

DMARC uses the results of SPF and DKIM, but adds a very important principle: alignment.

Simply put, DMARC checks whether the domains technically authenticated by SPF or DKIM sufficiently match the domain the user sees in the From address.

Why is alignment so important?

Without DMARC, an attacker could in certain scenarios authenticate a message technically via another valid domain while trying to show your company domain in the visible From address.

DMARC therefore links the technical authentication with the domain the recipient actually sees.

What are p=none, p=quarantine and p=reject?

In a DMARC record, the domain owner also publishes a policy.

The main options are:

Why do you often start with p=none?

An organisation does not always immediately know which systems send email on behalf of its domain.

With DMARC in monitoring mode, you can collect reports and discover:

• which systems send mail on behalf of your domain;
• which messages pass or fail SPF;
• which messages pass or fail DKIM;
• which sending flows achieve DMARC alignment;
• which unknown sources are trying to use your domain.

So SPF alone is not enough?

Correct.

SPF is important but has limitations. For example, SPF checks a technical SMTP sender domain and not necessarily the domain the end user sees in the From field.

Moreover, certain forms of email forwarding can cause SPF to fail.

That is why you want to combine SPF with DKIM and DMARC.

Does DMARC protect against all phishing?

No.

That is an important nuance.

DMARC primarily protects against abuse where someone tries to directly spoof your real domain name as the sender.

An attacker can still register another domain name that looks very similar to yours.

SPF, DKIM and DMARC are therefore essential security layers, but they do not replace good anti-phishing protection and security awareness.

Does this also affect whether my email ends up in spam?

Yes, email authentication is an important signal for receiving mail platforms.

Microsoft advises organisations to correctly configure SPF, DKIM and DMARC. Missing or incorrect authentication can contribute to messages being classified as unwanted or suspicious.

But here too applies:

Receiving providers also look at:

• sender reputation;
• sending behaviour;
• spam complaints;
• bounces;
• content;
• links and attachments;
• sender history;
• other anti-phishing and anti-spam signals.

I use Microsoft 365. Is this then automatically set up correctly?

No, not for your own custom domain.

Microsoft 365 provides the technology to send email and support DKIM, but the correct DNS configuration for your company domain still needs to be properly set up.

Moreover, companies often use other sending platforms alongside Microsoft 365.

For example:

• CRM;
• invoicing;
• website;
• marketing;
• HR platform;
• ticketing;
• applications that automatically send reports.

Can I configure this myself?

Technically, SPF, DKIM and DMARC are DNS records, but correct implementation requires more than just adding three records.

First, it must be determined:

• which systems send email on behalf of your domain;
• which domain those systems use for SPF;
• which systems support DKIM;
• whether DKIM is correctly signed;
• whether SPF and/or DKIM correctly align with the visible From domain;
• what DMARC reports show;
• which systems need to be adjusted before a strict policy is possible.

Have specialists manage email authentication

Good email security goes beyond adding one SPF record.

A professional approach includes among others:

• inventory of all sending sources;
• correct SPF policy;
• DKIM for suitable mail platforms;
• DMARC monitoring;
• analysis of DMARC reports;
• correction of non-aligned mail flows;
• controlled introduction of quarantine or reject;
• ongoing follow-up when new mail platforms are added.

Do you currently have an email issue?

Are you a FLEXAMIT customer and suddenly your emails fail SPF, DKIM or DMARC, get rejected or systematically end up in spam?

In summary