SPF, DKIM and DMARC: how they detect fake emails

Authentication headers allow verifying whether a message has actually been sent by an authorized server and if its content has been tampered with. They are essential for detecting spoofing and fraud, as they add a technical layer of validation that complements the visible headers.

SPF (Sender Policy Framework)

The SPF record defines which servers are authorized to send email on behalf of a domain. When a message arrives at the destination server, it checks if the sending IP is included in the domain's SPF policy.

• Allows validating if the sending server is authorized.
• Does not protect the message content, only the legitimacy of the server.
• An SPF failure does not necessarily imply fraud, but it does require review.

DKIM (DomainKeys Identified Mail)

The DKIM system adds a cryptographic signature to the message. This signature is generated at the sending server and validated at the receiving server using a public key published in the domain's DNS.

• Guarantees that the content has not been modified during transit.
• The signature must match the sender's domain.
• It is one of the most reliable signals of message integrity.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

The DMARC policy combines SPF and DKIM to establish validation and alignment rules. It allows the domain to indicate what should be done if a message fails the checks.

• Defines policies: none, quarantine, or reject.
• Requires alignment between the visible domain and the domains used in SPF and DKIM.
• Allows receiving reports on spoofing attempts.

Conclusion

Authentication headers are fundamental for verifying the technical legitimacy of an email. Although they are not visible to the average user, their analysis allows for the detection of spoofing even when the main headers appear correct. In the next article, we will delve into transport routes and how to track the actual journey of a message. Rutas de transporte del correo electrónico: cómo rastrear el origen

Email Transport Routes