I85PREP
⌘ K
CC-CEM study materials
CC-CEM study resources

CC-CEM: Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

CC-CEM · Work through your exam, one topic at a time.

All guide sections

Email Authentication and Anti-Spoofing (SPF, DKIM, DMARC, ARC)

This domain tests whether you can read an authentication result chain and predict the outcome. Questions typically give you records or a trace header and ask why a message passed, failed, or landed in quarantine.

SPF

SPF authorises sending IPs for the envelope domain (Return-Path). Mechanisms are evaluated left to right: all, include, a, mx, ip4, ip6, exists; ptr is discouraged. The record must stay within 10 DNS-lookup-consuming terms and roughly two void lookups, or the result is permerror - which most receivers treat as a failure. Qualifiers are + (pass), - (fail), ~ (softfail), ? (neutral). SPF breaks on forwarding because the envelope sender is rewritten.

DKIM

A public key is published at <selector>._domainkey.<domain> with tags p, k, h, bh, and canonicalisation (relaxed/simple, header and body set independently). Signing covers selected headers plus a hash of the body. Keys should be at least 2048-bit, rotated, and issued per third-party sender with its own selector. The l= body-length tag lets a verifier accept a truncated body and is a known replay weakness.

DMARC

DMARC binds the visible From header to SPF (envelope) and DKIM (d=) through alignment, relaxed or strict (aspf/adkim). Policy tags: p, sp, pct, rua, ruf, fo, rf. The record sits at _dmarc.<domain>, and the organisational domain is derived using the public suffix list. Aggregate reports (rua) are XML; forensic reports are privacy-limited and rarely sent by large receivers.

ARC

ARC lets a forwarding intermediary seal a message with an AAR, AMS, and AS set, incrementing the instance counter. A receiver may use a valid chain to soften a DMARC failure caused by forwarding. ARC never overrides a DMARC pass and is not a general bypass.

Worked example

A newsletter uses an ESP that stamps its own bounce domain in the envelope but signs DKIM with d=news.example.com, aligned to From. DMARC passes on DKIM alignment alone even though SPF fails alignment - SPF's pass/fail is irrelevant when the aligned identifier differs. If a mailing list later breaks the body hash, both mechanisms fail and the message is subject to policy.

Traps

  • Publishing -all while a forgotten SaaS sender still exists.
  • Blowing the 10-lookup budget through chained includes.
  • Believing p=none blocks anything - it only requests reporting.
  • Forgetting sp leaves subdomains at the weaker default.
  • Assuming DMARC stops display-name spoofing from an unrelated domain.