Email Security Explained: SPF, DKIM and DMARC (Security+)
What you’ll know
Why anyone can type any “From” address, how SPF, DKIM and DMARC work together to catch fakes, what the three DMARC policies do, and how to check the records for any domain in seconds.
Why it matters. Phishing that pretends to come from your own company, your bank or your boss is the most common way attacks start. These three DNS records are how receiving mail servers tell the real sender from the fake one, and they’re named in the Security+ objectives.
The problem: email has no built-in proof of sender
The “From” line in an email is just text, like the return address on an envelope. Without extra checks, anyone can send a message that claims to be from ceo@yourcompany.com. SPF, DKIM and DMARC are DNS records the real domain owner publishes so receiving servers can check.
Three records, three jobs
| Record | Question it answers | How |
|---|---|---|
| SPF | Is this server allowed to send mail for the domain? | A TXT record listing the domain’s approved sending servers. -all = reject everything else (hard fail); ~all = mark it suspicious (soft fail). |
| DKIM | Was this message really sent by the domain, and unchanged on the way? | The sending server signs each message with a private key; the public key sits in DNS at selector._domainkey.domain. The selector name is in the message’s DKIM-Signature header. |
| DMARC | What should happen if SPF and DKIM don’t line up with the From address? | A TXT record at _dmarc.domain with a policy and an address for reports. |
The three DMARC policies
| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
| p=none | Deliver it as normal, but send reports | Start here: watch the reports to find all your legitimate senders |
| p=quarantine | Put it in spam or junk | Once the reports show your real mail passes |
| p=reject | Refuse it outright | The goal: spoofed mail never arrives |
DMARC also needs alignment: the domain checked by SPF or DKIM has to match the domain in the visible From address, so a scammer can’t pass SPF with their own domain while showing yours. DMARC passes when either SPF or DKIM passes and aligns; you don’t need both. Set up both anyway, because forwarding often breaks SPF while DKIM survives.
p=none is a sign that says “please don’t forge our email” and then politely forwards you a report every time someone does. It’s step one, not the finish line. — Nyx
Try it: look up any domain
$ dig +short TXT google.com | grep -i spf "v=spf1 include:_spf.google.com ~all" $ dig +short TXT _dmarc.google.com "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"
Google lists its sending servers in SPF (soft fail for anything else) and tells the world to reject mail that fails DMARC. rua is where receivers send their daily reports.
PS> (Resolve-DnsName -Type TXT google.com | Where-Object { $_.Strings -match 'spf' }).Strings v=spf1 include:_spf.google.com ~all PS> (Resolve-DnsName -Type TXT _dmarc.google.com).Strings v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
Now try your own domain, your school or your employer. No DMARC record at all, or p=none for years, means spoofed mail from that domain still gets delivered. To see whether a message you received passed, open its full headers and look for spf=pass, dkim=pass and dmarc=pass.
Where this fits
This is part of the free CompTIA Security+ roadmap: every StashGrid lesson mapped to the exam domains.
NextIncident response: the six steps→
Go deeper
- Read email headers and report phishing — find spf=pass and dkim=pass in a real message
- DNS explained — where these TXT records live
- Cryptography and PKI — the signatures DKIM uses
Explainer, written by StashGrid with AI help and checked against the CompTIA Security+ V8 (SY0-801) exam objectives before publishing. Every command was run in Ubuntu 24.04 (WSL, OpenSSL 3.0.13) and Windows 11 PowerShell on 30 Oct 2026. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.