SPF, DKIM and DMARC: the three authentication checks we verify

Modern email carries three overlapping checks that tell you whether a message is genuinely from the domain it claims. Your Email Forensic Report reports the result of each.

• SPF (Sender Policy Framework) — the claimed domain publishes a list of servers allowed to send its mail. SPF checks whether the sending server was on that list. A fail or softfail is a strong sign the sender was not authorised by the domain they claim to be.
• DKIM (DomainKeys Identified Mail) — the sending domain signs the message with a cryptographic key. If the signature verifies, the message genuinely originated from that domain and was not altered in transit. A missing or broken signature is a red flag.
• DMARC — ties SPF and DKIM to the visible From address and states what should happen when they fail. A DMARC failure means the message is impersonating the From domain.

Genuine mail from a reputable organisation almost always passes all three. Spoofed and forged messages routinely fail one or more — and the report explains which, and what that tells you about the sender.