Email Authentication Protocols

DomainKeys Identified Mail (DKIM)

• DNS TXT Record, stores the DKIM public key.
• Email authentication method that allows senders to sign their email messages with a cryptographic key.
• Email providers then use these signatures to verify that the messages weren’t modified while in transit. Using DKIM, the email client server can verify that the email was sent from the expected domain/address.

Sender Policy Framework (SPF)

• DNS TXT Record.
• Email authentication method that is designed to prevent email spoofing.
• Domain owners use SPF to tell email providers which servers are allowed to send email from their domains.

Domain-based Message Authentication, Reporting and Conformance (DMARC)

• DNS TXT Record.
• Email authentication protocol that uses SPF and/or DKIM to detect email spoofing.
• To comply with DMARC, messages must be authenticated through SPF, DKIM, or both.
• An example of a DMARC policy: Quarantine 25% of the emails that failed authentication by sending them to the Spam folder.

Tag	Description
Version (v)	The v tag is required and represents the protocol version. An example is v=DMARC1
Policy (p)	The required p tag demonstrates the policy for domain (or requested handling policy). It directs the receiver to report, quarantine, or reject emails that fail authentication checks. Policy options are: 1) None 2) Quarantine or 3) Reject.
Percentage (pct)	This DMARC tag specifies the percentage of email messages subjected to filtering. For example, pct=25 means a quarter of your company’s emails will be filtered by the recipient.
RUA Report Email Address(s) (rua):	This optional tag is designed for reporting URI(s) for aggregate data. An rua example is rua=mailto:CUSTOMER@for.example.com.
RUF Report Email Address(s) (ruf):	Like the rua tag, the ruf designation is an optional tag. It directs addresses to which message-specific forensic information is to be reported (i.e., comma-separated plain-text list of URIs). An ruf example is ruf=mailto:CUSTOMER@for.example.com.
Forensic Reporting Options (fo):	The FO tag pertains to how forensic reports are created and presented to DMARC users.
ASPF Tag (aspf):	The aspf tag represents alignment mode for SPF. An optional tag, aspf=r is a common example of its configuration.
ADKIM Tag (adkim):	Similar to aspf, the optional adkim tag is the alignment mode for the DKIM protocol. A sample tag is adkim=r.
Report Format (rf):	Forensic reporting format(s) is declared by the DMARC rf tag.
Report Interval (ri):	The ri tag corresponds to the aggregate reporting interval and provides DMARC feedback for the outlined criteria.
Subdomain Policy (sp):	This tag represents the requested handling policy for subdomains.