Email Authentication: Build SPF, DKIM and DMARC, Then Break Them

Every message carries two sender addresses. The envelope sender is given in the SMTP MAIL FROM command and is what bounces go back to. The From header is inside the message and is what the mail client shows the reader. Nothing in SMTP requires them to match. This gap is why email spoofing works at all, and every authentication standard that follows exists because of it.

SPF is a TXT record listing which IP addresses may send mail for a domain. The receiver takes the envelope sender's domain, looks up that record, and checks the IP that connected against it. It says nothing about the From header, and nothing about the message body. Reading real records is the fastest way to see the shape of it.

DKIM signs chosen headers and the body with a private key. The receiver fetches the public key from DNS and checks the signature. Because it travels inside the message, it survives forwarding, and because it covers the body, it proves the content was not changed on the way. You will generate a key, sign a message, and verify it without any DNS at all.

A signature you have never seen fail is a signature you are trusting on faith. Change a single character of the signed body and verify again. This is also the quickest way to understand a class of real incidents: anything in the delivery path that rewrites a message, such as a mailing list appending a footer or a gateway rewriting links, invalidates the signature in exactly this way.

SPF checks the envelope. DKIM checks a signing domain. Neither has anything to say about the From header, which is the only address most readers ever look at. DMARC closes that gap. It requires at least one of SPF or DKIM to pass and to be aligned with the From domain, and it tells receivers what to do when nothing is. Go back to the spoof you sent in step two and work out what DMARC would have done with it.

You have now done by hand what a sending provider does for every message. The last step is to see the finished article. Send one message through a provider that handles SPF, DKIM and DMARC alignment for you, then read the Authentication-Results header the receiving side writes. That header is the receiver's verdict, and it is the thing to check first whenever mail is going missing.