Glossary
Email spoofing
Email spoofing is sending a message with someone else's address in the visible `From` header. SMTP has no built-in verification of that field, so writing an arbitrary value has always been trivial. SPF, DKIM and DMARC exist to make it detectable: together they let a receiving system check whether a message claiming to be from a domain was actually authorised by it, and a DMARC policy tells the receiver what to do when it was not.
Why it is possible at all
SMTP separates the envelope, used for routing, from the message headers, which are what the recipient is shown. Neither was designed with authentication.
The `From` header is simply text written by the sending client. Nothing in the protocol compares it to anything.
The envelope sender is equally unverified in plain SMTP, which is what SPF was introduced to address.
The protocol dates from a network of mutually trusting hosts. Every authentication mechanism since has been an addition on top rather than a change to it.
What the three mechanisms each contribute
SPF publishes which servers may send for a domain, and authenticates the envelope sender. It breaks on forwarding, because the forwarding server is not on the list.
DKIM signs the message, and the signature survives plain forwarding. It breaks when an intermediary modifies signed content.
DMARC ties either result to the visible `From` header through alignment, and publishes a policy saying what to do on failure.
Together they cover exact-domain spoofing well. A DMARC policy of `reject` means a receiving system that honours it will not deliver a forged message using your domain.
What authentication does not cover
Look-alike domains. A message from `examp1e.com` with a perfect SPF, DKIM and DMARC setup on that domain passes every check — it is just not your domain.
Display name abuse. The name shown in most clients is free text, so a message from an unrelated address can display your organisation's name.
Subdomains you do not control, and domains you own but do not protect. A DMARC record at the apex with a subdomain policy is what covers the latter.
Compromised legitimate accounts, where the mail really is authorised by the domain and the authentication correctly says so.
How to see your own exposure
Check that SPF, DKIM and DMARC all exist and that the DMARC policy is `quarantine` or `reject` rather than `none`.
Read DMARC aggregate reports. They show every source sending as your domain, which is how forgotten services and genuine forgery are both found.
Check the subdomain policy. Without one, a subdomain inherits the apex policy, and with an explicit `sp=none` it inherits nothing.
Register the obvious look-alike variants of your domain where the cost is reasonable, since no email standard addresses them.
Frequently asked questions
- Can email authentication stop all spoofing?
- It stops forgery of your exact domain at receivers that honour your policy. Look-alike domains and display-name abuse are outside what it covers.
- Why can anyone put my address in the From field?
- SMTP never verified that header. SPF, DKIM and DMARC were added afterwards to make the forgery detectable rather than impossible.
- Does a DMARC policy of none protect anything?
- No. It only requests reports. Protection begins at quarantine and is complete at reject.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website