SPF/DKIM/DMARC
By default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.
Term
description · examples · notesBy default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.
Description
You get attempts to send 'from your domain' to a partner rejected or flagged, and reports showing who sends in your name. This protects your domain's reputation with others and reduces spoofed internal mail.
It's set on DNS, costs little, and is among the cheapest controls with real effect — but only when DMARC is actually in reject mode, not merely 'monitor'. Many domains publish the records and leave them toothless.
What people often say
- 'We have SPF, we're protected' — without DMARC at reject, spoofed mail still lands
- 'It stops all phishing' — it addresses domain spoofing, not look-alike domains or compromised mailboxes
Covers / does not cover
Covers
- Verifying the sender domain's authenticity
- Reducing spoofing of your exact domain
- Visibility through DMARC reports into who sends in your name
Does not cover
- It doesn't stop phishing from look-alike domains (typosquatting) — it covers only your exact domain
- It doesn't inspect content or attachments (that's email-security)
- It doesn't help if the attacker compromised a real mailbox (BEC from inside)
Notes
- DMARC in 'monitor only' mode is a lock that reports the break-in but doesn't lock the door. The value is in moving to reject.
Mentioned in the news
Threats
reduces 5Threats it reduces. Select one to open its page.
Techniques
neutralizes 2Techniques it neutralizes. Select one to open its page.