DMARC, SPF And DKIM.

What Are DMARC, SPF and DKIM?

They are three email authentication standards. Each one helps a receiving mail system check whether a message really comes from the domain it claims to come from. A domain is the part of an address after the @ sign.

• SPF stands for Sender Policy Framework.
• DKIM stands for DomainKeys Identified Mail.
• DMARC stands for Domain-based Message Authentication, Reporting and Conformance.

What Problem Do These Standards Solve?

RFC 7208, the SPF standard, says email on the Internet can be forged in a number of ways. It says existing protocols place no restriction on what a sending host can use as the “MAIL FROM” of a message.

How Does SPF Work?

RFC 7208 says SPF lets domain administrators explicitly authorize the hosts that are allowed to use their domain names. A receiving host can then check that authorization. The domain owner publishes the list in DNS, the public system that maps domain names to data. The receiver looks up that record and compares it with the host that sent the message.

How Does DKIM Work?

RFC 6376 says DKIM permits a person, role, or organization that owns the signing domain to claim some responsibility for a message. It does this by associating the domain with the message. The receiver checks a cryptographic signature and queries the signer’s domain directly to get the public key. RFC 6376 also says that a failed signature check does not force rejection of the message. The receiver can apply its own policy.

How Does DMARC Work?

RFC 7489 describes DMARC as a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting. The domain owner publishes the policy in DNS. Receivers check mail against the policy and apply it to mail that fails the DMARC check.

RFC 7489 lists three policy choices:

• none, where the domain owner requests no specific action on delivery.
• quarantine, where failing messages are treated as suspicious.
• reject, where receivers are asked to reject mail that fails the DMARC check.

DMARC also provides feedback. RFC 7489 describes two report types. Aggregate reports carry aggregate data on message streams relevant to the domain owner. Failure reports are sent almost immediately after a receiver detects a DMARC failure.

How Does a Receiver Decide What to Do With One Message?

RFC 7489 sets out the steps a receiving mail system follows for each message.

1. 1Read the From domainThe receiver takes the domain in the From header of the message.
2. 2Look up the DMARC recordIt queries DNS for a DMARC policy record. With none found, DMARC evaluation ends.
3. 3Run SPF and DKIMBoth checks run, and their results and domains are passed on.
4. 4Check alignmentIf an authenticated domain matches the From domain, the message passes DMARC.
5. 5Apply the policyA message that fails is handled by the domain’s policy: none, quarantine or reject.

A pass needs only one of the two checks to pass with an aligned domain. If neither passes, the message fails DMARC.

How Do They Relate to Phishing and Typosquatting?

Phishing is a fake message that tries to trick a person into acting. Typosquatting is the registration of a domain that looks like a real one. RFC 7489 says DMARC is designed to prevent bad actors from sending mail that claims to come from legitimate senders. It also says the specification does not address visually similar domain names, which it calls “cousin domains”. So DMARC does not cover a look-alike domain registered by someone else.

What Does CISA Say About Them?

CISA describes SPF as a protocol that lists the IP addresses authorized to send email for a domain. It describes DKIM as adding a digital signature to email headers. It describes DMARC as an email authentication protocol that uses SPF and DKIM to validate the sender and block fraudulent messaging.

Is DMARC the Same as SPF and DKIM?

No. SPF and DKIM are checks. RFC 7489 says DMARC builds on them, so a domain owner can state a policy and receive reports. DMARC needs the SPF and DKIM results to work.

Can a Domain Owner See Who Sends Mail in Their Name?

RFC 7489 says DMARC reporting is meant to give domain owners feedback about mail that uses their domain.

DMARC is aimed at email spoofing, where the sender of a message is forged.