SPF, DKIM & DMARC explained — with the exploits, the alignment rules, and the policies that block phishing before it reaches your inbox.
Every email travels through a gauntlet of checks. Here's exactly where each protocol kicks in — and where attackers try to slip through.
Return-Path,This single mismatch is the attack surface that lets billions of spoofed emails reach inboxes every day — even when SPF passes.
From: headerYour inbox shows noreply@paypal.com — looks completely legitimate. Users trust this.
Return-PathSPF validates the Return-Path (aka Envelope-From) domain — invisible to the recipient and can be set to any attacker-controlled domain.
Attacker sets Return-Path: bounce@evil.com (SPF passes) while From: shows ceo@yourcompany.com. SPF ✅. Phishing delivered.
DMARC enforces that the Return-Path domain must align with the visible From: domain. No alignment = rejected or quarantined.
SPF, DKIM, and DMARC work together as a layered defence. Each one addresses a different layer of trust — and all three are required for full protection.
Return-Path domain, not From:d= tag must align with From: domainDMARC requires that the domain in SPF's Return-Path OR DKIM's d= tag matches the visible From: domain.
DMARC lets you start with monitoring and ramp up to full enforcement — a zero-risk path to stopping spoofing completely.
Monitor mode. No action taken on failing emails — they land in the inbox. Reports sent to your rua address so you can understand your email flow before enforcing.
Suspicious emails are sent to the spam/junk folder. Good intermediate step while validating that all your legitimate senders are configured correctly.
Full enforcement. The receiving server drops failing emails outright — they never reach the inbox. This is the gold standard and stops spoofing completely for your domain.
Don't go straight to p=reject. Follow this proven ramp-up path to avoid blocking legitimate email.
Start monitoring. Collect aggregate reports for 2–4 weeks to map all your sending sources (ESP, CRM, ticketing, etc.)
Add every authorised sending IP and include mechanism. Keep your SPF record under the 10-lookup limit.
Configure DKIM signing for each mail platform. The d= tag must match your From: domain for alignment.
Apply policy to 10% of failing messages first. Monitor reports. Increase pct incrementally over 2–4 weeks.
Once reports show only legitimate senders passing, enforce p=reject. Your domain is now fully protected.
Configure your options and get a production-ready DMARC TXT record to publish in your DNS.
_dmarcTXT3600dig TXT _dmarc.yourdomain.comEmail spoofing isn't a niche threat. It's the primary vector for phishing, BEC fraud, and ransomware delivery globally.
Five minutes of DNS configuration separates you from full email authentication enforcement. Don't leave the door open.