Email authentication explained: DMARC, DKIM and SPF

Email remains one of the most vital tools for communication in business, but it’s also one of the most exploited by cyber criminals. Phishing attacks, email spoofing, and impersonation scams cost businesses millions each year and can damage brand reputation and customer trust. To protect themselves, organisations must implement email authentication protocols like SPF, DKIM and DMARC. These tools validate emails, protect domains from misuse and secure communication channels. In this blog post, we’ll explore what email authentication is, break down how SPF, DKIM and DMARC work, and explain why they’re crucial for your organisation’s cyber security strategy. 

What is email authentication? 

Email authentication is a group of technical standards that help verify that an email is from the sender it claims to be from. These standards protect users from spam, phishing, and spoofing by enabling email providers to validate that emails sent from a domain are authorised and haven’t been tampered with.
 

Think of email authentication as a way for your email to carry ID, showing mail servers and recipients that your email is legitimate, and not from a cyber criminal impersonating your business.
 

The three key pillars of email authentication are: 

• SPF (Sender Policy Framework) 
• DKIM (DomainKeys Identified Mail) 
• DMARC (Domain-based Message Authentication, Reporting & Conformance) 

SPF: Sender policy framework 

SPF allows domain owners to specify which mail servers are allowed to send email on behalf of their domain. It works by checking the sending server’s IP address against a list published in the domain’s DNS records and ensures mail is coming from a trusted server. 

How SPF works: 

1. You publish an SPF record in your domain’s DNS. 
2. When an email is sent, the receiving server checks the SPF record. 
3. If the email comes from a listed IP, it passes; otherwise, it may be rejected or marked as spam.
 

Why it matters:
Without SPF, anyone can forge your domain name in an email (spoofing), making it appear as if it came from your company. SPF helps reduce this risk by verifying the source of the email. 

DKIM: Domainkeys identified mail 

DKIM adds a digital signature to your email header, which proves that the message hasn’t been altered in transit and confirms the email came from an authorised domain.
 

How DKIM works: 

1. A private key on your mail server signs the email. 
2. A matching public key is published in your domain’s DNS. 
3. The receiving server uses the public key to verify the signature. 
4. If the email content has been changed or wasn’t sent from your server, verification fails.
 

Why it matters:
DKIM ensures email integrity and authenticity. Even if a hacker intercepts the email, any change to the message content would break the signature, triggering a warning. 

DMARC: Domain-based message authentication, reporting & conformance 

DMARC builds on SPF and DKIM, tying them together into a policy that tells receiving servers what to do when a message fails authentication checks; reject, quarantine, or do nothing. It also provides reporting so domain owners can see who is sending email on their behalf.
 

How DMARC works: 

1. You publish a DMARC record in your DNS that references your SPF and DKIM records. 
2. When an email fails both SPF and DKIM checks, DMARC instructs the recipient’s server how to handle it.
3. You receive detailed reports on failed authentication attempts and who’s sending from your domain.
 

Why it matters:
DMARC gives you control. You can actively prevent spoofed emails from reaching inboxes and monitor for abuse of your domain. 

What about MTA-STS? 

MTA-STS stands for Mail Transfer Agent Strict Transport Security. It’s an email security protocol that ensures emails sent to your domain are transmitted securely over encrypted connections (TLS) and only delivered to authorised mail servers. It helps protect your email communications from interception, downgrade attacks, and man-in-the-middle (MITM) attacks during transit. MTA-STS works alongside SPF, DKIM, and DMARC to provide comprehensive email security. 

The risks without email authentication 

Failing to implement SPF, DKIM, and DMARC leaves your organisation open to email-based attacks. Common risks include: 

• Email spoofing: Cyber criminals can impersonate your domain to trick customers, partners or employees. 
• Phishing attacks: Fraudulent emails that look legitimate can steal sensitive data or install malware. 
• Reputation damage: If users receive malicious emails that appear to come from your domain, trust in your brand suffers. 
• Poor email deliverability: Without proper authentication, your legitimate emails may end up in spam folders or be blocked entirely. 

Why email authentication Is essential 

Email authentication isn’t just a technical checkbox, it’s a vital part of your cyber security and email deliverability strategy. Here’s why it matters: 

• Improves deliverability: Authenticated emails are less likely to be flagged as spam. 
• Enables visibility: DMARC reporting shows who’s using your domain to send email, legitimately or not. 
• Supports regulatory compliance: Many industries now view email authentication as part of best-practice cyber security frameworks.  

Regulations and compliance 

Since February 2024, email providers like Google and Yahoo have required stricter email authentication standards, meaning that emails without verification using SPF, DKIM and DMARC, may be blocked or rejected. Organisations that send more than 5,000 emails daily are required by most email providers to implement DMARC. 

Beginning March 2025, it has been mandatory for organisations handling card payments to implement DMARC, to help reduce the risk of data breaches and cyber attacks. Those handling credit card data must comply with PCI DSS v4.0 which has its own set of security standards covering not just DMARC but encryption, acceptable use policies, data retention and more. 

Conclusion 

Email remains a common part of cyber attacks, but with the right defences in place, you can reduce your risk significantly. SPF, DKIM and DMARC work together to verify your emails, protect your domain, and keep malicious emails out of inboxes. 

Implementing email authentication may require coordination between your IT team or IT support provider, and DNS host, but the benefits, including greater security, better deliverability, and stronger brand protection, are well worth the effort. 

If you’re unsure whether your email domain is properly secured or need help setting up SPF, DKIM and DMARC, our team is available to advise.