SPF, DKIM, and DMARC: What Email Authentication Actually Does

SMTP — the protocol that carries email — was designed in 1982 with no mechanism for verifying that a sender is who they claim to be. Anyone with a mail server can send an email claiming to be from [email protected] , [email protected] , or any address on any domain. SPF, DKIM, and DMARC are the retrofit that closes most of that gap. Here's how they actually work. Email spoofing — sending a message that falsely claims a sender address — has existed for as long as email itself. It's the enab