DMARC, SPF and DKIM are three email authentication standards that help a receiving mail system check whether a message really comes from the domain it claims. SPF lists the hosts allowed to send for a domain, DKIM adds a signature to the message, and DMARC lets the domain owner set a policy and get reports based on both.
- Also Called4other namesemail authentication · DMARC · SPF
- Related Terms3linked entriesPhishing · Typosquatting · Spear phishing
What are DMARC, SPF and DKIM?
They are three email authentication standards. Each one helps a receiving mail system check whether a message really comes from the domain it claims to come from. A domain is the part of an address after the @ sign.
- SPF stands for Sender Policy Framework.
- DKIM stands for DomainKeys Identified Mail.
- DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
Why does email need authentication?
RFC 7208, the SPF standard, says email on the Internet can be forged in a number of ways. It says existing protocols place no restriction on what a sending host can use as the “MAIL FROM” of a message.
How does SPF work?
RFC 7208 says SPF lets domain administrators explicitly authorize the hosts that are allowed to use their domain names. A receiving host can then check that authorization. The domain owner publishes the list in DNS, the public system that maps domain names to data. The receiver looks up that record and compares it with the host that sent the message.
How does DKIM work?
RFC 6376 says DKIM permits a person, role, or organization that owns the signing domain to claim some responsibility for a message. It does this by associating the domain with the message. The receiver checks a cryptographic signature and queries the signer’s domain directly to get the public key. RFC 6376 also says that a failed signature check does not force rejection of the message. The receiver can apply its own policy.
How does DMARC work?
RFC 7489 describes DMARC as a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting. The domain owner publishes the policy in DNS. Receivers check mail against the policy and apply it to mail that fails the DMARC check.
RFC 7489 lists three policy choices:
- none, where the domain owner requests no specific action on delivery.
- quarantine, where failing messages are treated as suspicious.
- reject, where receivers are asked to reject mail that fails the DMARC check.
DMARC also provides feedback. RFC 7489 describes aggregate reports, which carry aggregate data on message streams relevant to the domain owner, and failure reports, which are sent almost immediately after a receiver detects a DMARC failure.
How do they relate to phishing and typosquatting?
Phishing is a fake message that tries to trick a person into acting. Typosquatting is the registration of a domain that looks like a real one. RFC 7489 says DMARC is designed to prevent bad actors from sending mail that claims to come from legitimate senders. It also says the specification does not address visually similar domain names, which it calls “cousin domains”. So DMARC does not cover a look-alike domain registered by someone else.
What does CISA say about them?
CISA describes SPF as a protocol that lists the IP addresses authorized to send email for a domain. It describes DKIM as adding a digital signature to email headers. It describes DMARC as an email authentication protocol that uses SPF and DKIM to validate the sender and block fraudulent messaging.
Is DMARC the same as SPF and DKIM?
No. SPF and DKIM are checks. RFC 7489 says DMARC builds on them, so a domain owner can state a policy and receive reports. DMARC needs the SPF and DKIM results to work.
Can a domain owner see who sends mail in their name?
RFC 7489 says DMARC reporting is meant to give domain owners feedback about mail that uses their domain.
DMARC is aimed at email spoofing, where the sender of a message is forged.
Also Called.
- Nameemail authentication
- NameDMARC
- NameSPF
- NameDKIM
Questions.
-
What is the difference between SPF, DKIM and DMARC?
SPF lists the hosts allowed to send mail for a domain. DKIM adds a cryptographic signature to a message. DMARC builds on both, so the domain owner can state a policy and receive reports about mail that uses the domain.
-
How does SPF work?
The domain owner publishes a list of authorized sending hosts in DNS. A receiving mail system looks up that record and compares it with the host that sent the message, as described in RFC 7208.
-
What are the DMARC policy options?
RFC 7489 lists three: none, where no specific action is requested, quarantine, where failing messages are treated as suspicious, and reject, where receivers are asked to reject mail that fails the DMARC check.
-
Does DMARC stop lookalike domains?
No. RFC 7489 says DMARC is designed to prevent bad actors from sending mail that claims to come from legitimate senders, but it does not address visually similar domain names, which it calls cousin domains.
Sources
In Our Research
- 1 How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense July 2026
- 2 Lookalike Domains: How a Single Character Difference Becomes a Brand’s Worst Nightmare May 2026
- 3 UAC-0102: Inside a Covert Espionage Operation Targeting Ukraine and Beyond March 2026
- 4 Looking at Your Company Through the Eyes of an Attacker: What Is an Attacker’s-Eye View? March 2026
- 5 LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
- 6 TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns January 2026