What is Email Authentication SPF, DKIM, and DMARC and Why It’s Important Explained in Plain English

If you are asking “What is SPF?” or “What is DKIM?” or “What is DMARC”, or generally “What is email authentication” and “Why do I need it”, well, you are far from alone. There is a lot of confusion around email authentication, so here is a plain English, simple explanation of what each email authentication is, and what it does.

First, SPF stands for Sender Policy Framework, DKIM stands for DomainKeys Identified Mail, and DMARC stands for Domain-based Message Authentication, Reporting and Conformance. But, in the immortal words of the movie Airplane, that’s not important right now. What is important is that you understand how these things work.

Email Authentication Overview

The bottom line is that SPF, DKIM, and DMARC all live in a tiny text file where your domain is hosted. They do not live in your email program, or at the inbox providers. (DKIM actually does have a second piece that does live in your email, but don’t worry about that for now.)

Let’s say that your domain is example.com. Your SPF, DKIM, and DMARC live in a tiny text file at example.com. Not on the example.com website, but actually within example.com’s DNS record (for this simple explanation you also don’t need to understand what DNS is, but it’s important that you understand that this is where the text file containing your SPF, DKIM, and DMARC resides).

This file is known as a TXT file. (DMARC can also live as a CNAME in your DNS record, but that too is not important right now.) What is important is that you really understand that each of these email authentication mechanisms live as a text-based DNS record where your DNS is hosted. They don’t primarily live with your email program, and they don’t live with your email service provider. Many people are confused about this because it’s called email authentication, and it helps you get your email delivered to the people to whom you are sending it, so it seems logical that it would be part of your email program. But it’s not.

You can think of your DNS (which stands for Domain Name Service) as sort of like a directory that other computers on the Internet can check to find out where on the Internet your website lives (at what IP address), and a bunch of other things related to your domain, including what other places are authorized to send email on behalf of your domain. When an inbox provider gets email that claims to be from example.com, the inbox provider can see where the email actually originated, and the inbox provider will check in the TXT file in example.com’s DNS records to confirm that the originating system that the email is coming from is authorized to assert that it’s coming from example.com.

Email Authentication: SPF

So keeping with the example of your domain being example.com, let’s say that you use Google’s Gsuite to send your email, and you send your email out as being from:

jo**@ex*****.com











.

In your SPF (Sender Policy Framework) records, in that TXT file, you are going to have information that tells the inbox providers “it’s ok for email coming from Gsuite to use the domain example.com”

Now let’s say that someone is pretending to be you, and pretending to send email as you (this is known as spoofing). Let’s say that they are sending their email from spoofcentral.com, and claiming that it is coming from example.com.

When the inbox providers get that email, they are going to look up your SPF information in that TXT file in your DNS record, and see if you have “spoofcentral.com” listed as a place that is authorized to send email as “example.com”. And, of course, it won’t be there.

This act of looking up in the TXT records to see if a different site is authorized to send email as the domain is called “authentication”.

That is how SPF works. For a more in-depth look at SPF and SPF records, see here.

Email Authentication: DKIM

DKIM (DomainKeys Identified Mail) is an additional layer of authentication, which relies on a string of characters that look like gibberish, known as a public “key”. That public key lives in… wait for it… you got it! The TXT record in your DNS records.

This public key is used by the inbox providers to decrypt an encrypted signature that is embedded in the email that you send out (so you do need to involve your email program for this one).

For a more in-depth look at DKIM go here.

Email Authentication: DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is yet another layer of authentication, which tells the inbox providers that you publish SPF and DKIM, and what the inbox provider should do if they receive email that claims to come from you but that doesn’t pass either the SPF or the DKIM authentication checks (for example they should reject it, or put it in the spam folder, etc.).

So rather than being an authentication mechanism itself, DMARC describes what you want a receiving system to do with email that fails the other two authentication mechanisms (SPF and DKIM). For a more in-depth explanation of DMARC go here.

This is a very basic, simplified overview of SPF, DKIM and DMARC. The key take-away is that it’s very important to have these email authentication mechanisms set up for any and all email that you send. If you would like assistance checking to make sure that your email authentication is set up correctly, or assistance in getting it set up, authentication analysis and set-up assistance is included as part of our all inclusive, all-you-can-eat, month to month service!