Email Authentication

Email authentication helps receiving mail servers determine if an email actually came from the claimed sender, protecting against impersonation and phishing attacks.

Why it matters

• Email spoofing is the primary vector for phishing and BEC (Business Email Compromise) attacks.
• Without authentication, attackers can send emails appearing to be from your domain.
• Major email providers (Google, Microsoft) require authentication for deliverability.
• Failing to authenticate can land legitimate emails in spam folders.

The three pillars

• SPF (Sender Policy Framework): DNS record listing servers authorized to send email for your domain.
• DKIM (DomainKeys Identified Mail): Cryptographic signature proving the email wasn't altered in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Policy telling receivers what to do when SPF/DKIM fail, plus reporting.

DMARC policies

• p=none: Monitor mode—collect reports but don't enforce.
• p=quarantine: Failed emails go to spam folder.
• p=reject: Failed emails are blocked entirely.

Implementation roadmap

1. Inventory all systems sending email as your domain.
2. Implement SPF by adding authorized senders to DNS.
3. Configure DKIM signing on your mail servers.
4. Start DMARC with p=none to gather data.
5. Analyze DMARC reports to identify legitimate senders missed by SPF/DKIM.
6. Gradually move to p=quarantine then p=reject.

Common mistakes

• SPF records exceeding the 10 DNS lookup limit.
• Not including all third-party senders (marketing tools, CRM, etc.).
• Moving to p=reject too quickly before all senders are authenticated.
• Ignoring DMARC aggregate reports.