Email Authentication

Sender Policy Framework

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that lists which IP addresses are authorized to send email for a domain. The receiving server looks up the SPF record of the envelope From domain and checks if the sending server's IP is in the authorized list. SPF passes if the IP matches, fails if it does not. SPF alone does not prevent display-name spoofing -- that requires DMARC.

DomainKeys Identified Mail

DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to outgoing email. The sending server signs selected headers and the message body with a private RSA or Ed25519 key. The public key is published in a DNS TXT record at selector._domainkey.domain. Receiving servers verify the signature. DKIM proves the message was sent by a server holding the private key and that the signed headers and body were not modified in transit.

Domain-based Message Authentication, Reporting, and Conformance

DMARC (RFC 7489) builds on SPF and DKIM to give domain owners control over what receiving servers do with mail that fails authentication. A DMARC record at _dmarc.domain specifies a policy (p=none, p=quarantine, p=reject) and a reporting address (rua=). DMARC requires alignment: the From header domain must match the SPF envelope domain or the DKIM d= domain. DMARC with p=reject stops spoofing of the visible From address.

Authenticated Received Chain

ARC (Authenticated Received Chain, RFC 8617) preserves email authentication results through forwarding and mailing list hops. When a message is forwarded, the forwarder adds three ARC headers: ARC-Authentication-Results (the original auth results), ARC-Message-Signature (a DKIM-like signature over all ARC headers), and ARC-Seal (a chain seal). The final receiver can verify the ARC chain even if SPF and DKIM now fail due to forwarding.