SPF and DKIM

What They Are and Why They Matter

SPF and DKIM are how email servers verify a message actually came from who it claims to. Without them, anyone can send mail that looks like it came from your domain. With them, receiving servers can authenticate the sender.

Most phishing campaigns exploit missing or weak SPF and DKIM — it is the difference between a spoofed domain landing in an inbox vs. getting rejected outright.

The Three Layers

SPF — Sender Policy Framework

SPF is a DNS TXT record that lists which servers can send mail for your domain.

Anatomy of an SPF Record

v=spf1 include:_spf.google.com ~all

SPF Mechanisms (in order of evaluation)

Common SPF Mistakes

DKIM — DomainKeys Identified Mail

DKIM uses public-key cryptography to sign each outgoing email. The sender’s mail server generates a signature header using a private key. The receiving server looks up the corresponding public key in DNS (via a DKIM TXT record) and verifies the signature.

How DKIM Works

Sender (private key)  ── signs ──>  Email with DKIM-Signature header
                                      │
                                      ▼
Receiver (public key)  <── verifies <── DNS lookup of selector._domainkey.example.com

DKIM Header Example

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=example.com; s=google;
 h=mime-version:from:date:message-id:subject:to;
 bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
 b=GwBkL5hKx7yQz3Xp...

DKIM DNS Record Example

The receiving server queries: google._domainkey.example.com

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD..."

DMARC — Domain-based Message Authentication, Reporting & Conformance

DMARC tells receiving servers what to do when SPF and/or DKIM fail. It also provides daily reports about who is sending email claiming to be from your domain.

DMARC Record Example

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100"

DMARC Progression Strategy

1. Monitor — Set p=none. Review reports for 30 days to see what mail is failing authentication.
2. Quarantine — Move to p=quarantine. Identify legitimate senders that are failing and fix their SPF/DKIM configuration.
3. Reject — Set p=reject. Only after confirming all legitimate mail passes authentication.

Verification — Command-Line Tools

Verify SPF with nslookup

# Check SPF record for a domain
nslookup -type=TXT example.com

# Expected output (in a working SPF setup):
# example.com  text = "v=spf1 include:_spf.google.com ~all"

# Directly query for SPF (type 99)
nslookup -type=SPF example.com

Alternative with dig (more readable):

dig TXT example.com +short
# "v=spf1 include:_spf.google.com ~all"

Verify DKIM with nslookup

# DKIM records use the format: <selector>._domainkey.<domain>
nslookup -type=TXT google._domainkey.example.com

# Expected output:
# google._domainkey.example.com  text = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD..."

Verify DMARC with nslookup

nslookup -type=TXT _dmarc.example.com

# Expected output:
# _dmarc.example.com  text = "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100"

Online Verification Tools

Walkthrough — Verifying a Domain’s Email Security

Let’s walk through verifying wyzsec.com:

Step 1 — Check SPF:

$ dig TXT wyzsec.com +short
"v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"

✅ SPF authorizes Google Workspace and Microsoft 365 mail servers. The -all means mail from any other server is rejected.

Step 2 — Check DKIM:

$ dig TXT google._domainkey.wyzsec.com +short
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8..."

✅ DKIM public key published. Selector google matches Google Workspace.

Step 3 — Check DMARC:

$ dig TXT _dmarc.wyzsec.com +short
"v=DMARC1; p=reject; rua=mailto:dmarc@wyzsec.com; pct=100"

✅ DMARC set to reject. Reports are sent to dmarc@wyzsec.com.

Step 4 — Send a test email and check headers:

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of user@wyzsec.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=user@wyzsec.com;
       dkim=pass header.i=@wyzsec.com;
       dmarc=pass (p=REJECT, sp=REJECT)

✅ All three pass.

Detection — Identifying Email Spoofing in Logs

Microsoft 365 Message Trace — Look for:

• SPF: Fail or DKIM: Fail
• Authentication-Results header shows spf=softfail or dkim=fail
• DMARC disposition: delivered but DMARC p=quarantine or p=reject in the dmarc=fail row

Exchange Online — Get-MessageTrace to see:

• SPFStatus: Fail
• DKIMStatus: Fail
• DMARCStatus: Fail

Suspicious patterns:

• Email from your CEO but SPF/DKIM both fail
• Lookalike domains (wyzsec-support.com, wyzsec-verify.com) sending mail that passes their own SPF/DKIM — this is a lookalike domain phishing attack, which SPF/DKIM for your domain does NOT protect against (that requires DMARC reporting and domain monitoring)
• Sudden increase in DMARC aggregate reports showing many unauthorized senders

Related

• Kill Chain — covers the kill chain concepts
• OSI Model — covers the osi model concepts
• Phishing — detection and response for T1566 techniques
• Business Email Compromise Response — detection and response for T1566, T1114, T1098, T1586 techniques
• Initial Access Response — detection and response for T1566, T1190, T1189, T1133 techniques

Sources

• Google Workspace SPF Guide
• DMARC.org Overview
• MITRE ATT&CK T1566
• RFC 7208 — SPF
• RFC 6376 — DKIM
• RFC 7489 — DMARC