Email authentication
SPF, DKIM, and DMARC
Three DNS-based standards decide whether the world trusts email from your domain. Lavawall® checks that all three are set up correctly and keeps watch so a new sender does not quietly break your deliverability.
Start free, no credit card Learn the basics
Stop spoofing · protect deliverability · monitor DMARC
Understanding SPF, DKIM, and DMARC: essential tools for email security
SPF, DKIM, and DMARC are three DNS records that let receiving mail servers confirm an email really came from your domain and was not altered on the way, which is the core defence against spoofing, phishing, and impersonation.
Sender Policy Framework (SPF)
What is SPF?
SPF stands for Sender Policy Framework. It is a protocol that lets domain owners specify which mail servers are authorised to send email on their behalf. This information is published in the domain's DNS (Domain Name System) records.
Why is SPF important?
SPF helps prevent email spoofing, where attackers send email that appears to come from a trusted domain. By verifying the sender's IP address against the SPF record, email servers can determine whether the message is legitimate.
Consequences of not using SPF
Without SPF, unauthorised servers can send email from your domain, leading to spam and phishing attacks. This can damage your domain's reputation and cause legitimate email to be marked as spam or rejected.
DomainKeys Identified Mail (DKIM)
What is DKIM?
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to outgoing email, which the receiving mail server can verify. The signature is created using a private key and verified using a public key published in the sender's DNS records.
Why is DKIM important?
DKIM ensures the email content has not been tampered with during transit. It also helps establish the sender's credibility, improving email deliverability and reducing the chance of messages being marked as spam.
Consequences of not using DKIM
Without DKIM, email can be altered by attackers, leading to misinformation and potential security breaches. It also makes it harder for recipients to trust that your email is authentic.
Domain-based Message Authentication, Reporting, and Conformance (DMARC)
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It builds on SPF and DKIM by telling email servers how to handle messages that fail SPF or DKIM checks. DMARC policies can be set to "none," "quarantine," or "reject."
Why is DMARC important?
DMARC helps ensure consistent email authentication across domains. It gives domain owners reports on authentication failures, so they can monitor and address unauthorised email activity. DMARC significantly reduces the risk of phishing attacks and improves overall email security.
Consequences of not using DMARC
Without DMARC, there is no unified policy for handling unauthenticated email, leading to inconsistent security. That means higher exposure to phishing and no visibility into authentication problems. On top of that, in February 2024, Google and Yahoo both began blocking email from organisations that send over 5,000 messages without DMARC configured. We expect that threshold to keep falling.
Where does Lavawall® fit into the SPF, DKIM, and DMARC puzzle?
Lavawall® checks your domain to confirm that SPF, DKIM, and DMARC are configured correctly. We can also monitor your DMARC so you catch any email providers that others (typically marketing) add for things like surveys and newsletters, before those messages start getting blocked.
Conclusion
SPF, DKIM, and DMARC are essential tools for protecting your domain from email-based threats. Implementing them ensures your email is authenticated, trusted, and secure. Neglecting them can lead to serious consequences, including spam, phishing attacks, and damage to your domain's reputation. By understanding and using SPF, DKIM, and DMARC, you can safeguard your email communications and maintain the integrity of your domain.
If you have any questions or need further help setting these up, reach out through our chat, phone, or email on our contact page.
Common questions
- What is SPF and why does it matter?
- Sender Policy Framework (SPF) is a DNS record listing which mail servers may send email for your domain. Receiving servers check the sending IP against it, which helps stop spoofing. Without SPF, unauthorised servers can send from your domain, driving spam and phishing and hurting your reputation so legitimate mail is flagged or rejected.
- What is DKIM and why does it matter?
- DomainKeys Identified Mail (DKIM) signs outgoing email with a private key that the receiver verifies against a public key in your DNS. It proves the message was not altered and improves deliverability. Without DKIM, attackers can tamper with messages and recipients have less reason to trust your email.
- What is DMARC and why does it matter?
- DMARC builds on SPF and DKIM and tells receiving servers how to treat mail that fails those checks, using a policy of none, quarantine, or reject. It also reports authentication failures back to you. Without it, unauthenticated mail is handled inconsistently and you have no visibility into abuse.
- Do Google and Yahoo require DMARC?
- Since February 2024, Google and Yahoo have blocked email from organisations that send over 5,000 messages without DMARC configured. We expect that threshold to keep falling, so configuring DMARC now protects your deliverability.
- How does Lavawall® help with SPF, DKIM, and DMARC?
- Lavawall® checks your domain to confirm SPF, DKIM, and DMARC are set up correctly, and it can monitor DMARC so you catch new senders that others add (often marketing tools) before their messages start getting blocked.