Email authentication with MailOut
Last updated on
DMARC, DKIM, and SPF are closely related email authentication protocols that are used together to enhance email security and prevent attacks such as phishing, spam, or spoofing.
Return path DNS record is used to enable bounce management.
| Type | Function | What it protects | DNS record type | MailOut requirement |
|---|---|---|---|---|
| DKIM | Secures email content | Prevents tampering and forgery | CNAME | mandatory |
| DMARC | Enforces authentication policies | Combines SPF/DKIM for stronger protection | TXT | mandatory |
| SPF | Verifies authorized sending servers | Prevents IP-based spoofing | TXT | mandatory |
| Return path | Can be used by third-party email services to send a response to MailOut for a specific message (i.e. in case of a hard bounce). | CNAME | optional |
DomainKeys Identified Mail (DKIM)
Section titled “DomainKeys Identified Mail (DKIM)”DomainKeys Identified Mail (DKIM) is an email authentication method that permits a person, role, or organization that owns the signing domain to claim responsibility for a message by associating the domain with the message.
The receiver can check that an email that claimed to have come from a specific domain was indeed authorized by the owner of that domain. It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message. The recipient system can verify this by looking up the sender’s public key published in the DNS. A valid signature also guarantees that integral parts of the email have not been modified since the signature was affixed.
STACKIT MailOut uses 3 DKIM DNS records to be able to rotate the used DKIM keypairs without service disruption.
Domain-based Message Authentication, Reporting and Conformance (DMARC)
Section titled “Domain-based Message Authentication, Reporting and Conformance (DMARC)”Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing. The purpose and primary outcome of implementing DMARC, is to protect a domain from being used in business email compromise attacks, phishing email and email scams.
Once the DMARC DNS entry is published, any receiving email server can authenticate the incoming email based on the instructions published by the domain owner within the DNS entry. If the email passes the authentication, it will be delivered and can be trusted. If the email fails the check, depending on the instructions held within the DMARC record, the email could be delivered, quarantined, or rejected.
DMARC extends two existing email authentication mechanisms, Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). It allows the administrative owner of a domain to publish a policy in their DNS records to specify how to check the From: field presented to end users and how the receiver should deal with failures, and it provides a reporting mechanism for actions performed under those policies.
DMARC is defined in the Internet Engineering Task Force’s published document RFC 7489, dated March 2015, as “Informational”.
Sender Policy Framework (SPF)
Section titled “Sender Policy Framework (SPF)”Sender Policy Framework (SPF) is an email authentication method that ensures the sending mail server is authorized to originate mail from the email sender’s domain. This authentication only applies to the email sender listed in the “envelope from” field during the initial SMTP connection.
SPF allows the owner of an Internet domain to specify which computers are authorized to send mail with envelope-from addresses in that domain, using Domain Name System (DNS) records. Receivers verifying the SPF information in TXT records often reject messages from unauthorized sources before receiving the body of the message.