Email Authentication (SPF, DKIM, DMARC)
Domain 4 tests SPF, DKIM, and DMARC mechanics and how Proofpoint displays and enforces results. Expect questions on alignment, qualifiers, DNS lookup limits, selector lookup, aggregate reports, and policy actions.
Core rules
- SPF authorizes sending IPs for the envelope domain; it does not authenticate the visible From.
- SPF has a 10-DNS-lookup limit; use ip4/ip6 and include sparingly.
- DKIM signs selected headers and the body with a selector published in DNS; verification fails if signed content changes.
- DMARC requires SPF or DKIM alignment with the From domain; p=none monitors, quarantine and reject enforce; rua receives aggregate reports.
- ARC can preserve authentication across forwarders, but it is not DMARC and does not replace alignment.
Worked example
A newsletter has SPF pass for mailer.example and DKIM pass with d=mailer.example, but From is [email protected]. DMARC fails because neither authenticated identifier aligns with yourcompany.example. Fix by adding yourcompany.example to the DKIM d= domain or by re-signing at the boundary; do not simply relax SPF, which does not solve alignment.
Traps that cost marks
Reading SPF pass as DMARC pass; ignoring alignment; publishing multiple SPF records; moving to p=reject before monitoring; and assuming DKIM always survives forwarding.