Ask me anything about SPF, DKIM of DMARC. (Or E-mail Anti Spoofing)...
CISOwithHoodie@SecGuru_OTX
6 views
Jun 02, 2025
~2 min read
Advertisement
1
Ask me anything about SPF, DKIM of DMARC. (Or E-mail Anti Spoofing)
It can be a difficult subject, I would like to help.
Thread👇
It can be a difficult subject, I would like to help.
Thread👇
2
The basics:
SPF: is to indicate which server is allowed to mail on behalf of your domain. Set this up!
DKIM: digitally sign your mail so it can be checked for "authenticity".
DMARC: this is a policy that must be followed if the above is not correct.
SPF: is to indicate which server is allowed to mail on behalf of your domain. Set this up!
DKIM: digitally sign your mail so it can be checked for "authenticity".
DMARC: this is a policy that must be followed if the above is not correct.
3
Do you have domains or look-a-like domains that are NOT used for Email?
Always set SPF to -all and DMARC to p=reject (even if these domains have no MX records).
This is the only way to indicate to receiving mail servers that no mail may be sent from those domains.
Always set SPF to -all and DMARC to p=reject (even if these domains have no MX records).
This is the only way to indicate to receiving mail servers that no mail may be sent from those domains.
4
If you have DMARC set up properly, external meeting forwards to other external domains will be blocked.
The domain of the initial external meeting organizer continues to apply (i.e. spoofing).
Please include this in your communication to end users!
The domain of the initial external meeting organizer continues to apply (i.e. spoofing).
Please include this in your communication to end users!
5
Automatic E-mail forwards where the original external domain remains applicable are also blocked with DMARC Reject.(this is also spoofing)
(But best practice is to block automatic forwards anyway)
(But best practice is to block automatic forwards anyway)
6
Again, Anti Spoofing measures (SPF, DKIM and DMARC) starts with good Asset Management.
If you don't know which servers are allowed to send email on behalf of your domain, you will run into problems.
But if you don't know this, then you have much bigger problems...
If you don't know which servers are allowed to send email on behalf of your domain, you will run into problems.
But if you don't know this, then you have much bigger problems...
7
Always make sure your SPF record never has more than 10 DNS lookups, otherwise your record is invalid and your mail will be blocked at DMARC p=reject.
8
If you're fine with external or malicious individuals just being able to send email on behalf of your domain? Fine, then SPF and DMARC are wasted time.
If you have that setting, by the way, I do worry about the rest of your addressed risks (risk management).
If you have that setting, by the way, I do worry about the rest of your addressed risks (risk management).
9
@schenardie @richlilly Send mail from all servers allowed to mail on behalf of your domain to a Gmail address. Within Gmail, you can properly check the status of SPF, DKIM and DMARC (by selecting "show original").
Pretty simple but effective test method.
Pretty simple but effective test method.
10
@schenardie @richlilly Time for a complete rollout varies by organization. Always start with DMARC p=none (monitor) and only move to p=reject after you have completed all testing yourself (do not rely on DMARC reporting tools alone).
