Email Authentication Lab: SPF, DKIM and DMARC
Publish SPF, DKIM and DMARC records, send mail directly and through a forwarder or mailing list, and inspect the receiver’s authentication verdict, alignment and disposition.
Category: Networking
What You Will Learn
- SPF checks the MAIL FROM identity against the IP that connects to the receiver
- DKIM verifies a signed body and headers using a selector key in DNS
- DMARC needs SPF or DKIM to both pass and align with the visible From domain
- Forwarding commonly breaks SPF while an unchanged aligned DKIM signature can survive
- Mailing lists can break DKIM and use From rewriting to preserve DMARC
- DMARC policy, alignment modes and pct change how a receiver handles failure
Topics covered: email, spf, dkim, dmarc, dns, mail delivery, networking, interactive
// simulator
Email Authentication Lab: SPF, DKIM and DMARC
Publish SPF, DKIM and DMARC records, send mail directly and through a forwarder or mailing list, and inspect the receiver’s authentication verdict, alignment and disposition.
Goal: Make SPF pass for your own bounce domain. Turn on Use custom MAIL FROM, pick v=spf1 include:_spf.esp.example -all in SPF TXT, then press Send Direct.
Records and settings
Direct: SPF pass, DKIM pass, DMARC none.
Delivery paths
Pick a path, then press Send. Each card shows what the receiver decided.
Message at the receiver
Send after changing a record or ESP setting.
- Connecting IP
- 198.51.100.7
- MAIL FROM
- [email protected]
- Header From
- [email protected]
- DKIM d=
- esp.example
esp.example authorizes its ESP at 198.51.100.7. Checked esp.example; not aligned.
The body and signed Subject and From headers match s1._domainkey.esp.example. Checked esp.example; not aligned.
No DMARC record is published for the visible From domain. Looked up _dmarc.shop.example.
About the Email Authentication Lab
What you'll practise
- Publishing SPF for an ESP and recognizing its DNS lookup limit
- Signing with an aligned DKIM domain and placing the selector key in DNS
- Reading relaxed and strict SPF and DKIM alignment in a DMARC verdict
- Following how forwarding, list changes and From rewriting affect delivery
- Comparing monitoring, quarantine and reject DMARC policies
How it works
- Edit DNS and ESP settings: choose an SPF record, a DKIM signing domain, a selector key and DMARC policy.
- Send three paths: compare direct delivery, an unchanged forward without SRS, and a mailing list that changes the message.
- Read the receiver verdict: each path shows the identity checked, alignment, applied policy and inbox, spam-folder or rejection outcome.
Model boundary
The lab follows RFC 7489's pct behavior so you can see its effect, even though the newer DMARCbis draft removes pct. It checks SPF's MAIL FROM identity, not HELO, and does not model SRS or ARC. ARC can let some receivers trust a list's or forwarder's earlier authentication results.
Overview
Email authentication combines three DNS-backed checks that answer different questions. In this lab, SPF checks the MAIL FROM domain against the IP that connects to the receiver. DKIM checks a signature from its d= domain by fetching the selector key, and it fails when a mailing list changes a signed Subject or the body. DMARC starts from the visible Header From domain and passes when SPF or DKIM passes and aligns with that domain. You publish records for shop.example, choose whether the ESP signs as esp.example or shop.example, and send the same message on direct, forwarded and mailing-list paths. The forwarder keeps the message unchanged but does not use SRS, so SPF fails while aligned DKIM can survive. The list changes the Subject and body, which breaks the original DKIM signature. Its From rewrite makes lists.example visible instead, where aligned list SPF can pass DMARC. You also compare relaxed and strict alignment, monitoring and enforcement policies, pct behavior, and SPF permerror when more than 10 DNS-querying mechanisms are evaluated. The result cards show every checked domain, alignment result, policy and receiver disposition.
Try this
- Turn on "Use custom MAIL FROM bounce.shop.example", choose "v=spf1 include:_spf.esp.example -all" in SPF TXT and press "Send Direct" to see SPF pass aligned with shop.example.
- Choose "d=shop.example", turn on "Publish s1._domainkey.shop.example", and press "Send Forwarded" to see aligned DKIM survive.
- Choose "v=DMARC1; p=reject", turn on "List rewrites From and sets Reply-To", then press "Send Mailing list".
Frequently asked questions
- What identity does SPF authenticate in this lab?
- SPF checks the MAIL FROM domain against the IP that connects to the receiver. The lab deliberately leaves the optional HELO identity out, so its result is easier to compare across the three paths.
- Why can forwarded mail pass DMARC when SPF fails?
- A forwarder without SRS connects from an IP not authorized by the original sender, so SPF fails. Plain forwarding does not alter a valid DKIM signature, and an aligned DKIM pass is enough for DMARC to pass.
- Why does a mailing list rewrite From?
- Adding a list tag to Subject and a footer to the body breaks the original DKIM signature. Rewriting From to the list domain lets the receiver evaluate lists.example instead, where the list MAIL FROM and sending IP align for SPF and DMARC.
- What does DMARC pct change?
- RFC 7489 applies the requested failure policy to that percentage of failing mail; the remainder gets the next less strict policy. The lab uses a fixed representative bucket so the displayed result is repeatable, and notes that newer DMARCbis removes pct.
Try next
// simulator
HTTP/1.1 vs HTTP/2 vs HTTP/3 Lab
Load one page over HTTP/1.1, HTTP/2, and HTTP/3. Compare connection setup, multiplexed streams, TCP head-of-line blocking, and QUIC loss recovery in a request waterfall.
// simulator
CDN Edge Cache Lab
Set HTTP cache headers, send traffic through Frankfurt, Virginia and Singapore CDN edges, deploy, purge and inspect shared-cache hits, misses and 304 revalidation.
// simulator
Bounce Triage Simulator
Read a real SMTP bounce and decide what it is and what to do about it. Twelve genuine failures from Gmail, Outlook, Postfix and Proofpoint: hard bounces, soft bounces, content blocks, rate limits and spam complaints. Learn why the 4xx and 5xx class digit is a hint rather than the answer, which bounces to suppress permanently, which to retry, and what each mistake costs you in lost subscribers or lost sending reputation.