I am evaluating this report of a vulnerability on my website:

I just checked for DMARC records and DMARC policy for XXXXXX domain and there are none.

Effectively allowing for spam to originate from that domain.

However our domain already uses SPF. Is there any additional security provided by DMARC when already using SPF?


2 Answers 2


DMARC tells receiving mail servers what to do when they get a message that appears to be from your organization, but doesn't pass authentication checks, or doesn’t meet the authentication requirements in your DMARC policy record. Messages that aren't authenticated might be impersonating your organization, or might be sent from unauthorized servers.

DMARC is always used with these two email authentication methods or checks:

Sender Policy Framework (SPF) lets the domain owner authorize IP addresses that are allowed to send email for the domain. Receiving servers can verify that messages appearing to come from a specific domain are sent from servers allowed by the domain owner.

Domain Keys Identified Mail (DKIM) adds a digital signature to every sent message. Receiving servers use the signature to verify messages are authentic, and weren't forged or changed during transit.

SPF has a known weakness. Mail servers applying SPF policies check the RFC5321.Mailfrom header (commonly called the ‘envelope from header’) while email clients typically display the RFC5322.Mailfrom header (commonly called the ‘message/letter from header’) to the users as the source of an email.

Adversaries are aware of this weakness and use it to bypass SPF checks by using a domain they control in the envelope from header, and the domain they wish to spoof (but don’t control) in the message/letter from header.

DMARC addresses this weakness by checking that these two headers align.

DMARC enables domain owners to advise recipient mail servers of policy decisions that should be made when handling inbound emails claiming to come from the owner’s domain. Specifically, domain owners can request that recipients:

  1. allow, quarantine or reject emails that fail SPF and DKIM verification
  2. collect statistics and notify the domain owner of emails falsely claiming to be from their domain
  3. notify the domain owner how many emails are passing and failing email authentication checks
  4. send the domain owner data extracted from a failed email, such as header information and web addresses from the email body.

Notifications and statistics resulting from DMARC are sent as aggregate reports and forensic reports:

  1. aggregate reports provide regular high-level information about emails, such as which Internet Protocol (IP) address they come from and if they failed SPF and DKIM verification
  2. forensic reports are sent in real time and provide detailed information on why a particular email failed verification, along with content such as email headers, attachments and web addresses in the body of the email.
  • If the SPF already denies messages that are not from allowed IPs, then is DMARC really doing anything extra? Jun 14, 2021 at 4:00
  • Simply speaking, DMARC adds another layer of assurance and provides reporting. Even if the SPF or DKIM checks pass, DMARC also requires the domains used by either one of those two protocols to align with the domain found in the “From” address. Only then will DMARC pass.
    – NetServOps
    Jun 14, 2021 at 4:11
  • @WilliamEntriken A great resource for information related to DMARC alignment can be found here: dmarcian.com/alignment
    – NetServOps
    Jun 14, 2021 at 4:26
  • That URL shows that Google (my mail provider) "supports DMARC via SPF". I am still seeing that a properly configured SPF is sufficient to avoid spoofing. Jun 14, 2021 at 13:55
  • @WilliamEntriken Unless you also have DKIM, then SPF is not enough.
    – NetServOps
    Jun 14, 2021 at 23:30

SPF does not know about identifier alignment. Before DMARC more receivers honored an SPF HARDFAIL (-ALL). Very few honor hardfail now and zero major MBPs honor it.

DKIM isn’t a policy layer since DMARC came along. You must have dmarc to get the reporting and a rational policy layer that takes into account the alignment of the 5322.From with the 5321.from in spf’s case. And alignment with the d= domain in DKIM. Neither spf nor dkim know anything about alignment. So just passing the without regard for alignment is all spf and dkim can do and neither can provide the reporting. Since I can use my own domain to pass spf and dkim sign emails in which I spoof your domain, spf and dkim are mostly useful in their role of providing pass and alignment data to dmarc which can then report so that you can make good policy decisions implemented with dmarc, starting with p=none on up to p=reject.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.