SPF, DKIM and DMARC: email spoofing made simple

Email was invented in an era when people still trusted each other. The sender of a message can be filled in freely — much like you can write any return address on an envelope. To stop anyone from writing in your name unpunished, there are three building blocks.

SPF — who is allowed to send for your domain?

SPF is a list. In a DNS record you declare which servers may send email for your domain. Receiving servers look it up: did this message come from an authorised server? If not, it is suspicious.

DKIM — a signature that can't be copied

DKIM adds a cryptographic signature to every outgoing message. The public key lives in DNS, the private key only on your mail server. That lets the recipient verify the message really came from you and wasn't altered in transit.

DMARC — the rule that ties it together

SPF and DKIM say "matches" or "doesn't match". DMARC tells the recipient what to do about it: nothing, move to spam, or reject outright. You also receive reports on who sends in your name — including those who shouldn't.

The order that works in practice

1. Set up SPF and list your legitimate sending paths.
2. Enable DKIM so every message is signed.
3. Start DMARC in monitoring mode (p=none), read the reports, and only then tighten step by step to quarantine and reject.

Configure all three cleanly and you make it practically impossible for fraudsters to write convincingly in your name — while making your own genuine mail more likely to land in the inbox.