Email attackers often attempt to send messages that appear to come from a trusted domain. SPF and DMARC are public DNS policies that help receiving mail systems evaluate those messages.
What SPF does
SPF lists the servers that are authorized to send email for a domain. The policy is published as a TXT record beginning with v=spf1.
Common SPF endings
- -all: hard fail for unauthorized senders
- ~all: soft fail
- ?all: neutral result
- +all: allows every sender and should normally be avoided
SPF also has a limit on DNS-triggering mechanisms. A policy that requires too many DNS lookups may fail evaluation.
What DMARC does
DMARC tells receiving systems how to handle messages that fail aligned SPF or DKIM checks. The record is normally published at _dmarc.example.com.
DMARC enforcement levels
- p=none: monitoring only
- p=quarantine: request suspicious handling
- p=reject: request rejection of failing messages
Why p=none is only the beginning
A monitoring-only policy helps collect information, but it does not request enforcement. Organizations should review reports, correct legitimate sending systems and gradually move toward quarantine or reject.
Recommended deployment process
- Inventory every legitimate email sender.
- Publish one valid SPF record.
- Enable DKIM for supported sending services.
- Publish DMARC with reporting addresses.
- Review authentication reports.
- Increase enforcement after legitimate mail is aligned.