Understanding Email Authentication Headers: SPF, DKIM, and DMARC Explained

Email authentication plays an essential role in protecting against domain spoofing, phishing, and unauthorized email delivery. Three key standards, SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance), work together to verify sending servers, validate message integrity, and confirm that authentication aligns with the sender’s domain. Understanding how these protocols function, what their authentication results mean, and how they complement one another is important for troubleshooting email delivery problems, configuring mail security, and maintaining reliable communication across platforms such as Microsoft 365, Exchange Online, and Gmail.

SPF (Sender Policy Framework)

SPF answers one simple question:

Is this server allowed to send mail on behalf of this domain?

The sending mail server’s IP address is checked against the SPF record published in DNS for the sender’s domain. If the IP is listed or permitted by the SPF rules, the check passes.

Example conceptually:

The domain example.com publishes an SPF record saying:
Mail can only come from Microsoft 365 and this specific mail gateway.

When a message arrives, the receiving server compares the sending IP to that list.

PASS means:
The sending IP address is authorized by the domain’s SPF record.

Why it is important

SPF helps prevent basic spoofing where someone tries to send email pretending to be your domain from an unauthorized server.

From an admin perspective:

• It is your first line of defense against forged sender domains

• It is critical when configuring Exchange Online, third party mail relays, ticketing systems, and monitoring tools

• A failing SPF is one of the most common reasons for mail being marked as spam or rejected outright

Important limitation to remember:
SPF only checks the sending server, not the message content, and it can fail during forwarding scenarios unless configured carefully.

DKIM (DomainKeys Identified Mail)

DKIM answers a different question:

Was this message altered after it was sent, and was it really authorized by the sending domain?

DKIM uses cryptographic signatures. When the message is sent:

• The sending server signs certain parts of the message using a private key

• The receiving server retrieves the public key from DNS and verifies the signature

PASS means:

• The message has not been modified in transit

• The signature matches the sending domain’s DKIM key

In your example, gmail.com signed the message and the signature validated successfully.

Why it is important

DKIM provides message integrity and domain authenticity.

In practice:

• It prevents tampering with message headers and body

• It builds sender reputation over time

• It is heavily weighted by spam filters

From a troubleshooting angle similar to what you do with Exchange headers:

• If DKIM fails, you often see content modification by gateways, disclaimers, or misconfigured mail security tools

• DKIM is essential for high deliverability, especially for external mail and marketing platforms

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and adds policy enforcement.

DMARC answers:

What should the receiving server do if SPF or DKIM fail, and do they align with the visible From address?

A DMARC record tells receivers:

• Whether SPF or DKIM must pass

• Whether they must align with the From domain

• What action to take if authentication fails (none, quarantine, reject)

PASS means:

• Either SPF or DKIM passed

• The passing result aligns with the From address domain

• The sender’s DMARC policy requirements were satisfied

Why it is important

DMARC is the policy and enforcement layer.

Operationally:

• It prevents direct domain spoofing using your visible From address

• It gives domain owners visibility via aggregate and forensic reports

• It allows you to move from monitoring to enforcement safely

This is directly relevant to environments like Microsoft 365 and Gmail, where DMARC failures increasingly result in hard rejection instead of spam placement.

How they work together

Think of it like this:

SPF checks the server
DKIM checks the message
DMARC checks alignment and policy

A DMARC PASS usually means:

• SPF passed, or

• DKIM passed, or

• Both passed and aligned correctly

This layered approach is why modern mail systems rely on all three, not just one.