What are SPF, DKIM, DMARC and how to implement them ?

This guide is made to demystify the complex subject of email authentication protocols, including SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

We will focus on the pivotal role that these protocols play in fortifying email security, reducing fraud and enhancing deliverability, including the practical steps to follow to successfully implement SPF, DKIM, and DMARC in your email communications.

Understanding SPF (Sender Policy Framework)

What is SPF ?

SPF, or Sender Policy Framework, stands as a crucial email authentication protocol designed to reduce email spoofing and unauthorized use of domains. SPF serves as a robust framework that allows domain owners to declare which mail servers are authorized to send emails on behalf of their domain. In other terms, its main job is to prevent bad actors from pretending to send emails on behalf of your domain.

This is achieved through the creation of a DNS (Domain Name System) record that lists the approved mail servers, essentially serving as a digital "return address" for emails originating from that domain. So, as a domain owner, you create a special list using DNS (Domain Name System), your digital address book. This list includes the IP addresses of the servers authorized to send emails from a given domain – think of it as a trustworthy "return address."

The basic concept involves associating a specific IP address or range of IP addresses with a given domain. Then, when an email claiming to be from a particular domain arrives at its destination, the recipient's mail server checks the SPF record in the DNS in order to verify if the sending server is indeed authorized.

When an email claims to be from a certain domain, the recipient's mail server checks this digital address book (the SPF record) to see if the sending server is really allowed to send emails for your domain. It acts like a security check.

One of the primary roles of SPF is to prevent email spoofing, an act where cybercriminals manipulate the email header to make it appear as if the message is sent from a trustworthy source when, in reality, it is not. By establishing a clear and authenticated association between authorized mail servers and a domain, SPF creates a frontline defense against unauthorized entities attempting to exploit the credibility of a domain.

How does SPF work ?

The SPF process involves several steps, such as :

Initiation : When an email arrives at its destination, the recipient's mail server identifies the purported sending domain from the email header ; DNS Lookup : The server then performs a DNS lookup to retrieve the SPF record (domain's digital address book) associated with the sending domain. This SPF record is essentially a set of rules specified by the domain owner ; Verification : The retrieved SPF record lists the authorized IP addresses or ranges that are permitted to send emails on behalf of the domain, including the sender reputation. The recipient's mail server cross-references the source IP address of the incoming email with the information in the SPF record (the server compares this info with the source IP address of the incoming email, checking if they match) ; Decision Point : Based on this comparison, the server makes a crucial decision. If the source IP matches the SPF record, the email is legit and passes the SPF check. If there is a mismatch, suggesting the email is not coming from an authorized server, the SPF check fails.

Therefore, you must know that the foundation of SPF lies in the creation of SPF records within the DNS configuration of a domain. Here are some examples of the key components :

v=spf1 : This tag signifies the start of the SPF record and is generally followed by the mechanisms that define the rules ; Mechanisms : These are the rules that specify which IP addresses are authorized to send emails on behalf of the domain. Common mechanisms include "a" (allowing the domain's A record), "mx" (allowing the domain's MX record), and "ip4" or "ip6" (specifying specific IP addresses or ranges) ; Modifiers : Additional instructions, known as modifiers, can be included to refine the SPF policy and allow future extensions to the framework. For instance, "-all" indicates a strict policy where all other sources are considered unauthorized.

Exploring DKIM (DomainKeys Identified Mail)

What is DKIM ?

DKIM, or DomainKeys Identified Mail, is an email authentication technique made to verify the authenticity of email messages. It can be described as a digital notary for your emails, ensuring that they are genuine and have not been modified.

At its core, DKIM employs digital signatures to ensure that an email has not been modified during its transit and comes from the right sender.

You can picture DKIM as a digital seal affixed to each outgoing email. This seal, created using cryptographic keys, serves as a unique identifier and attests that the email has been authorized by the sending domain. In this way, this process aids in establishing trust between the sender and the recipient, assuring the latter that the email is legitimate and untampered.

The primary goal of DKIM is to bolster email security by addressing the following key aspects :

Message Integrity : DKIM prevents malicious actors from altering the content of an email as it crosses the internet. The digital signature coming with the email acts as a seal of authenticity, assuring the recipient that the message remains intact and unaltered ; Sender Authentication : DKIM authenticates the sender's identity, mitigating the risks associated with email forgery. By validating the origin of the email, DKIM helps to reduce phishing attempts and ensures that recipients can trust the legitimacy of the sender.

DKIM's Mechanism

At the heart of DKIM's mechanism lies the concept of digital signatures integrated within email headers :

Signing Process : When an email is sent, the sending server applies a digital signature to the email header using a private key unique to the sending domain. This signature serves as a cryptographic stamp, akin to a handwritten signature on a letter, and indicating the authenticity of the sender ; Header Fields : The DKIM signature is typically added to specific header fields within the email, such as the "DKIM-Signature" field. This field contains the crucial information needed for recipients in order to verify the signature.

Understanding DKIM's use of public and private keys is also fundamental to fully comprehend its mechanism. The sending domain possesses a private key, securely stored and known only by the domain owner or its authorized entities. This private key is used to generate the digital signature during the signing process.

In another hand, the public key, as its name suggests, is made publicly available in the DNS records of the sending domain, so the recipients can access this public key to verify the digital signature attached to the email.

The Role of DMARC (Domain-based Message Authentication, Reporting & Conformance)

Understanding DMARC

DMARC, or Domain-based Message Authentication, Reporting & Conformance, combines the powers of SPF and DKIM to make email authentication even stronger. Let's delve into this synergy :

SPF Integration : DMARC leverages SPF by allowing senders to specify in their DMARC records how SPF should be handled. This ensures that the alignment between the sender's domain and SPF authentication is fully verified, fortifying the email authentication process ; DKIM Integration : Similar to SPF, DMARC harmonizes with DKIM. It enables senders to define the desired treatment when DKIM alignment fails, reinforcing the validation of the sender's identity.

This means that by bringing SPF and DKIM into a cohesive framework, DMARC enhances the overall security of email communications, offering a comprehensive shield against unauthorized use of a domain.

DMARC also introduces a clear and effective policy-setting mechanism to strengthen email authentication. Here's a simplified summary :

Policy Options: DMARC provides three policy options for handling emails that fail SPF or DKIM checks : ’none,’ 'quarantine,' and ‘reject.’‘None' : This option is an initial monitoring phase where DMARC sends reports without taking action. It allows senders to assess the impact on legitimate emails ; ‘Quarantine' : In this phase, suspicious emails are directly directed to the recipient's spam or quarantine folder, which provides a cautious approach to potential threats ; ‘Reject' : The strictest option, 'reject,' ensures that emails failing authentication checks are outright rejected, minimizing the risk of fraudulent activities.Reporting Mechanism : DMARC introduces a robust reporting mechanism, generating feedback on the email authentication process. This valuable feedback assists senders in refining their email authentication setup and addressing any issues that may arise.

DMARC's Impact on Email Deliverability

DMARC exerts a strong influence on email routing, charting a course that enhances your email deliverability. In practice, DMARC scrutinizes the alignment between the domain in the "From" header and the authenticated domains through SPF and DKIM. When the alignment is confirmed, it signals to email service providers (ESPs) that the email is legitimate and can be delivered.

Based on the policy set by the sender (‘none,’ 'quarantine,' or ‘reject’), DMARC directs the ESP on how to handle emails that fail authentication. This decision significantly influences the chances of emails making it to the recipient's inbox.

Regarding the reporting and compliance aspects, you must keep in mind that DMARC generates detailed reports, providing precious insights about the alignment status, authentication results and even the disposition of emails. This feedback loop enables senders to identify issues, such as failed authentications or potential abuse of their domain.

Furthermore, through DMARC reports, senders can also gain visibility concerning how their emails comply with SPF and DKIM, so with the specified policies and authentication settings to guarantee an optimal deliverability.

Implementing SPF, DKIM, and DMARC

Step-by-Step Guide for SPF Setup

The creation of a secure email ecosystem begins with the meticulous setup of SPF (Sender Policy Framework). Let's simplify the process into actionable steps for an effective SPF implementation :

Step 1 : List Your Email Service Providers. Before diving into SPF setup, compile a comprehensive list of all of the Email Service Providers (ESPs) you use to send emails. This step is crucial to ensure that your SPF record encompasses all authorized sources.

Step 2 : Go to Your Domain's DNS Settings. Access the Domain Name System (DNS) settings of your domain. This is the virtual address book that directs the flow of internet traffic.

Step 3 : Create or Update Your SPF Record. Within the DNS settings, locate the area designated for SPF records. If your domain lacks an existing SPF record, create a new one. If you already have one, update it to include the information of all your ESPs.

Step 4 : Save and Wait 48 Hours. After configuring or updating your SPF record, save the changes in your DNS settings. It's important to note that changes to DNS records may take time to propagate across the internet. Allow a grace period of at least 48 hours for the updated SPF record to take effect.

Here is a formatting example :

v=spf1 include:_spf.example.com include:_spf.anotherprovider.com -all

and then replace "example.com" and "anotherprovider.com" with the actual SPF records of your ESPs.

If you use multiple ESPs, consolidate their "include" statements into one SPF record to avoid potential conflicts.

In order to maximize the effectiveness of your SPF, consider these best practices :

Regularly review and update your SPF record to reflect any changes in your email infrastructure and complete your email deliverability checklist,Avoid exceeding the DNS lookup limit (10) imposed by SPF to prevent authentication issues, and test your SPF record using tools like MailReach's SPF Checker to ensure its accuracy and effectiveness.

Setting Up DKIM

Securing your email communication involves also the implementation of DKIM (DomainKeys Identified Mail), through steps quite similar to the SPF ones :

Step 1 : List Your Email Service Providers. At first, you must compile a list of the Email Service Providers (ESPs) you use for sending emails. Unlike SPF, DKIM requires a separate record for each ESP.

Step 2 : Locate Your Domain's DNS Settings. Then, access the Domain Name System (DNS) settings specific to your domain. This can typically be found in the domain management portal under sections like "DNS Settings," "Manage DNS," or similar titles.

Step 3 : Generate DKIM Key(s) for Your Provider(s). For each ESP, initiate the process of generating a DKIM key. The exact steps may vary regarding the provider, so conduct a search specific to your ESP, such as "setup DKIM for [your provider].", and follow the guidelines provided by your ESP to generate the required DKIM key (Google Workspace, Outlook / Office365, Mailgun, Brevo, Amazon SES …).

Step 4 : Add DKIM to Your DNS. Within your domain's DNS settings, create a new TXT record to incorporate the DKIM key details provided by your ESP.

Step 5 : Save and Wait 48 Hours. After adding the DKIM records to your DNS, save the changes to allow a propagation period of at least 48 hours for the new DKIM configurations to take effect across the internet.

Let's say your domain is mydomain.com :

For example, if you use Google Workspace to send your day-to-day emails and Brevo to send newsletters to your subscribers, you will have to setup two different DKIM records.

One for Gmail (Google Workspace) and one for Brevo.

Then, access the Domain Name System (DNS) settings specific to your domain (DNS Settings).

Create a new TXT record to incorporate the DKIM key details provided by your ESP, so :
Name/Host/Alias : your provider's selector, often presented as selector._domainkey,Value/Answer/Destination : the public key supplied by your provider.

Deploying DMARC

In order to deploy DMARC, the process begins by going to your domain's DNS settings, just as you did for SPF and DKIM. Within these settings, you'll create a new DNS TXT record to house your DMARC policy.

Here is an example :

An example of a straightforward DMARC record, suitable for those who prefer to start with minimal intervention, looks like this :

v=DMARC1; p=none;

This default record initiates DMARC without taking immediate action on failing messages, offering a user-friendly entry point for those who want to keep things simple.

Beyond this default setting, you can tailor your DMARC policy by adjusting various parameters within the TXT record :

For instance, setting p=none signals email receivers to send DMARC reports without taking immediate action on failing messages, Additionally, specifying rua and ruf email addresses determines where aggregate and forensic reports are respectively sent.

Regarding the monitoring and the analysis of the DMARC reports, you can regularly check the email addresses specified in rua and ruf to access to valuable insights about authentication outcomes, helping you to identify and address potential issues.

Troubleshooting SPF, DKIM, and DMARC Issues

SPF, DKIM and DMARC protocols demand a certain level of precision and a clear understanding of potential pitfalls. When faced with authentication challenges, you may consider common configuration errors and leverage available tools and resources for diagnostics.

You can verify if your SPF record complies with your email sending practices. If you are using MailReach's Email Warmer, check if your SPF record corresponds to the chosen provider during the MailReach setup. A Gmail connection, for example, requires an SPF record including Gmail. For broader compatibility, use the "Any other SMTP" option and verify the required setup with the respective provider.

Moreover, scrutinize your SPF records to eliminate errors and consolidate multiple providers into a single SPF record. The correct syntax, starting with "v=spf1" and incorporating relevant "include" statements, is crucial. Here is an example of an SPF record for Gmail :

v=spf1 include:_spf.google.com ~all

For an effective DKIM configuration, tailor your DKIM records to align with your chosen provider during the MailReach setup. Whether using the Email Warmer or the free DKIM Checker, a distinct DKIM record matching the provider is important. If issues persist, initiate changes, and once again, await the 48-hour window for DNS changes and MailReach verification.

Conclusion

In summary, SPF, DKIM and DMARC stand as crucial guardians of email integrity, collectively fortifying your communication channels and providing a robust defense against unauthorized access and email fraud.

By implementing these authentication protocols, you can maximize at the same time your email security and your email deliverability.