Cybersecurity · Advanced level

Advanced level · Module 4: Identity, Email and Cloud Security · Lesson 3 of 4

Email Authentication: SPF, DKIM and DMARC

Stop others from sending email that pretends to come from your domain.

In this lesson you will

  • Explain SPF, DKIM and DMARC
  • Plan a DMARC deployment

Key concepts

SPFDKIMDMARC policyreports

The lesson

SPF lists which servers may send mail for your domain. DKIM signs messages so receivers can check they were not altered. Both are published in DNS.

DMARC tells receivers what to do when a message fails these checks — none, quarantine or reject — and sends reports back to you.

Deploy carefully: start with a monitoring policy (p=none), identify every legitimate sender from the reports, fix them, then move to quarantine and reject.

Step by step

  1. Look up a public domain's SPF and DMARC records.
  2. List the case NGO's sending services.
  3. Draft the SPF record.
  4. Plan DMARC stages.

Practice activity

Write the DMARC deployment plan for the case NGO.

Expected result: A staged plan from monitoring to enforcement.

Check your understanding

  1. What does SPF specify?

    Show answer

    Which servers may send email for a domain.

  2. Why start DMARC at p=none?

    Show answer

    To find all legitimate senders before blocking anything.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.