Email Authentication and Domain Protection (SPF, DKIM, DMARC)
Email Authentication and Domain Protection
This domain tests whether you can reason from DNS records and message headers to an authentication verdict. SPF, DKIM, and DMARC are separate controls; the exam expects you to know which identity each validates and how DMARC combines them.
Core rules
- SPF is a DNS TXT record that authorizes sending IPs for the envelope MAIL FROM domain, not the visible From header. Mechanisms include all, include, ip4, ip6, a, mx, and exists, with qualifiers +, -, ~, and ?. The evaluation limit is 10 DNS-querying mechanisms; exceeding it yields permerror.
- DKIM signs selected headers and a body hash with a private key; the public key is published at selector._domainkey.domain. Canonicalization and the l= body-length tag affect what is signed.
- DMARC requires identifier alignment: a passing SPF result for the envelope domain or a passing DKIM signature for the d= domain must align with the visible From domain. Relaxed alignment matches the organizational domain; strict alignment requires an exact match. Policy is none, quarantine, or reject, with pct, rua, ruf, adkim, aspf, and sp.
Worked example
A message shows From: [email protected]. SPF passes for [email protected], and DKIM passes with d=esp.example. Under relaxed alignment, esp.example does not align with contoso.com, so DMARC fails. If a second DKIM signature with d=contoso.com validates, DMARC passes through DKIM even though SPF alignment failed.
Traps
- Checking SPF against the visible From address rather than the envelope sender.
- Treating SPF pass as DMARC pass without checking alignment.
- Forgetting the 10-lookup limit, void lookups, or that pct=50 leaves half of failing mail subject to policy.
- Sending aggregate reports to an external domain without the required authorization record.