Email Authentication: SPF, DKIM and DMARC Explained

Email authentication is a critical component of modern email security, helping to protect both senders and recipients from spoofing, phishing, and other malicious activities. In this comprehensive guide, we'll dive deep into the three main email authentication protocols - SPF, DKIM, and DMARC - explaining what they are, how they work together, and best practices for implementing them effectively to secure your email communications.

What is Email Authentication?

Email authentication refers to a set of techniques and protocols used to verify the identity of an email sender and ensure that the email has not been altered in transit. Without proper authentication, it's relatively easy for attackers to send emails that appear to come from a trusted source, tricking recipients into revealing sensitive information, downloading malware, or falling victim to other scams.

The three main email authentication protocols are:

• SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of a domain
• DKIM (DomainKeys Identified Mail): Uses cryptographic signatures to verify that an email message was sent from an authorized source and has not been altered
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Builds upon SPF and DKIM to provide a clear policy for email authentication and reporting

The following diagram provides a high-level overview of how SPF, DKIM, and DMARC work together to authenticate email messages:

SPF: Sender Policy Framework

SPF is a DNS-based email authentication method that allows domain owners to specify which mail servers are permitted to send email on their behalf. By publishing an SPF record in their DNS settings, domain owners can help prevent unauthorized parties from sending emails that appear to originate from their domain.

How SPF Works

1. A domain owner publishes an SPF record in their DNS settings, specifying which mail servers are authorized to send email for the domain.
2. When an email is received, the receiving mail server looks up the SPF record of the envelope sender domain (the MAIL FROM, also shown as the Return-Path) or, if that is empty, the HELO name. It does not check the visible From address.
3. The receiving server compares the IP address of the sending mail server to the list of authorized servers in the SPF record.
4. If the sending server's IP is listed in the SPF record, the email passes SPF authentication. If not, the email fails SPF and may be flagged as suspicious.

Here's a simple example of an SPF record:

This SPF record specifies that only servers with IP addresses in the ranges 192.0.2.0/24 or 2001:db8::/32, as well as any servers listed in the SPF record for example.net, are authorized to send email for the domain example.com. The -all at the end indicates a hard fail for any other servers attempting to send email for this domain.

DKIM: DomainKeys Identified Mail

DKIM is an email authentication protocol that uses cryptographic signatures to verify that an email message was sent from an authorized source and has not been altered in transit. By signing emails with a private key and publishing the corresponding public key in the domain's DNS, email senders can provide recipients with a way to verify the authenticity of their messages.

How DKIM Works

1. The email sender generates a public-private key pair and publishes the public key in their domain's DNS as a DKIM record.
2. When sending an email, the sender's mail server uses the private key to create a digital signature of the email content and headers.
3. The signature is added to the email headers as a DKIM-Signature field.
4. Upon receiving the email, the recipient's mail server retrieves the sender's public key from their DNS and uses it to verify the DKIM signature.
5. If the signature is valid, the email passes DKIM authentication, confirming that it was sent from an authorized source and has not been modified. If the signature is invalid or missing, the email fails DKIM.

Here's an example of a DKIM signature header:

Implementing DKIM

To implement DKIM for your domain, follow these steps:

1. Generate a public-private key pair using a tool like OpenSSL.
2. Publish the public key in your domain's DNS as a TXT record with a selector prefix (e.g., default._domainkey.example.com).
3. Configure your mail server to sign outgoing emails using the private key.
4. Test your DKIM implementation using a tool like MXToolbox or mail-tester.com.

Here's an example of a DKIM DNS record:

SPF and DKIM: Better Together

While SPF and DKIM are powerful tools on their own, they work best when used together. SPF verifies the sender's identity at the server level, while DKIM verifies the authenticity and integrity of the email content itself. By implementing both, you can provide a more comprehensive level of email authentication and security.

DMARC: Tying It All Together

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds upon SPF and DKIM to provide domain owners with a clear way to specify their email authentication policies and receive reports on the results.

How DMARC Works

1. Domain owners publish a DMARC policy in their DNS as a TXT record.
2. When an email is received, the recipient's mail server performs SPF and DKIM checks. The message passes DMARC if at least one of them passes and aligns with the domain in the visible From address.
3. If the message fails DMARC, the receiving server applies the domain's policy (deliver, quarantine, or reject). Receivers that support reporting send the domain owner regular aggregate reports summarising the results.
4. Domain owners can use DMARC reports to monitor their email authentication results and identify potential security issues.

Here's an example of a DMARC record:

This DMARC record specifies the following policies:

• p=reject: Emails that fail DMARC (neither SPF nor DKIM passes with alignment) should be rejected
• rua=mailto:dmarc-reports@example.com: Aggregate reports should be sent to the specified email address
• ruf=mailto:dmarc-forensics@example.com: Forensic (failure) reports should be sent to the specified email address. Many large mailbox providers don't send these, so don't rely on them.
• fo=1: A failure report should be generated if either SPF or DKIM fails to produce an aligned pass
• adkim=s and aspf=s: Strict alignment should be used, so the DKIM and SPF domains must exactly match the From domain. The default, relaxed alignment, only requires the same organisational domain (so mail.example.com aligns with example.com).

Implementing DMARC

To implement DMARC for your domain, follow these steps:

1. Ensure that you have SPF and DKIM properly set up for your domain.
2. Decide on your DMARC policy (e.g., none, quarantine, or reject) and reporting preferences.
3. Create a DMARC record with your chosen policy and reporting settings, and publish it in your DNS as a TXT record at _dmarc.yourdomain.com.
4. Monitor your DMARC reports to track your email authentication results and identify any issues.

Best Practices for Email Authentication

To ensure the most effective email authentication and security, consider the following best practices:

• Implement SPF, DKIM, and DMARC for all domains you use to send email
• Make sure SPF or DKIM (ideally both) aligns with your From domain; relaxed alignment is fine for most senders, so only use strict alignment if you need it
• Monitor your DMARC reports regularly and act on any issues identified
• Keep your SPF and DKIM records up to date as your email infrastructure changes
• Use strong, unique DKIM keys for each domain and rotate them periodically
• Educate your users about email security best practices, such as identifying and reporting suspicious emails

Conclusion and Next Steps

Email authentication is a crucial aspect of modern email security, helping protect both senders and recipients from spoofing, phishing, and other email-based threats. By implementing SPF, DKIM, and DMARC, you can significantly improve your email security posture and protect your reputation as an email sender.

To get started with email authentication, follow these steps:

1. Assess your current email infrastructure and identify all authorized mail servers and sending domains
2. Implement SPF by creating SPF records for each sending domain
3. Set up DKIM by generating key pairs, publishing public keys in DNS, and configuring your mail servers to sign outgoing emails
4. Publish a DMARC record with a p=none policy to start monitoring your email authentication results
5. Gradually move to a p=quarantine and then a p=reject policy as you refine your SPF and DKIM configuration

Authentication is no longer optional for bulk senders: since 2024 Gmail and Yahoo require SPF, DKIM and DMARC for anyone sending large volumes to their users. Once your records are in place, send a test email to SpamBarometer to confirm that SPF, DKIM and DMARC all pass and align, and recheck whenever you add a new sending service.