DKIM and DMARC: Proving emails are genuine

In short: DKIM cryptographically signs outgoing mail, DMARC defines what recipients should do with mail that fails SPF or DKIM; together they make forged senders harder.

In more detail: The email protocol SMTP does not check the sender by itself: anyone can write “from: boss@company.com”. Three methods complement each other so that recipients can recognise forgeries: SPF, DKIM and DMARC. They are published as DNS records of the sender domain.

In Depth

SPF in brief

SPF lists the servers that may send mail for the domain. The recipient checks whether the delivering server belongs to it. Weakness: it concerns only the technical sender address (envelope) and breaks on forwarding.

DKIM: digital signature

The sending mail server signs parts of the message (headers and body) with a private key. The signature is in the DKIM-Signature header. The recipient fetches the public key from DNS (record selector._domainkey.company.com) and checks whether the message arrived unchanged and from an authorised sender. DKIM usually survives forwarding as long as the content is not modified.

DMARC: rules and reports

DMARC (_dmarc.company.com) ties both together and determines:

v=DMARC1; p=quarantine; rua=mailto:dmarc@company.com; adkim=s; aspf=s

• Alignment: the visible sender (From:) must match the domain confirmed by SPF or DKIM.
• Policy p: none (observe only), quarantine (spam folder), reject (refuse).
• Reports (rua): recipients send summaries of who sent mail in your name. This reveals forgotten legitimate senders and fraudsters.

Introducing it in practice

Start with p=none and read the reports. Switch all legitimate senders (web shop, newsletter service, ticket system) to SPF/DKIM, then to quarantine and finally reject. Large providers such as Google and Yahoo require SPF, DKIM and DMARC for bulk senders. To inspect, check headers for “Authentication-Results”: spf=pass dkim=pass dmarc=pass. Note: these methods show that the domain is right, not that the sender is trustworthy; phishing from look-alike domains remains possible.

See also: SPF, Phishing, Emails, DNS records