Email Authentication Protocols: SPF and DMARC
Defending Against Domain Spoofing and Business Email Compromise
Without cryptographic authentication, any malicious actor can forge your domain name in the From: header. Google and Yahoo enforce mandatory SPF and DMARC compliance for all bulk email senders.
Understanding SPF (Sender Policy Framework - RFC 7208)
SPF is a DNS TXT record declaring which IP addresses and third-party services (such as Google Workspace, Microsoft 365, Mailgun, or SendGrid) are authorized to send email on behalf of your domain. A crucial limitation of SPF is the 10 DNS lookup limit; exceeding 10 lookups invalidates the policy (returning a PermError).
Understanding DMARC (RFC 7489)
DMARC bridges SPF and DKIM authentication by instructing receiving mail servers how to treat messages that fail authentication:
p=none: Monitoring mode. Messages are delivered normally, but daily aggregate XML reports are sent to your specified reporting address.p=quarantine: Failing messages are diverted to the recipient's Spam/Junk folder.p=reject: Failing messages are rejected outright at the SMTP gateway, offering the highest level of phishing protection.
❓ Frequently Asked Questions
What is the 10 DNS lookup limit in SPF records?
The SPF specification mandates that an SPF evaluation must not require more than 10 DNS lookups (triggered by 'include', 'a', 'mx', 'ptr', or 'redirect' mechanisms). Exceeding this limit causes a PermError and message rejection.