DKIM (DomainKeys Identified Mail) is a way to digitally sign emails, ensuring they are authorized by the owner of a specific domain and haven’t been tampered with during transit. Here’s how it works: - The email sender generates a cryptographic public/private key pair, signs the email with the private key, and shares the public key in the DNS records of their domain. - The recipient retrieves the public key from DNS and verifies the signature in the email’s headers to confirm the message’s integrity. However, DKIM alone doesn’t stop scammers from spoofing an email’s From address and sending messages from unauthorized servers. For instance, a scammer could attach a valid DKIM signature for domain spoofed-example.com to the email while using [email protected] as the sender address. Despite this, the email would still pass a DKIM check.

SPF (Sender Policy Framework) ensures that the server sending an email is authorized to do so on behalf of the stated sender domain found in the email’s Return-Path header: - The owner of the domain publishes an SPF policy in the domain’s DNS records, specifying which IP addresses are allowed to send emails for that domain. - When an email is received, the recipient checks the sender domain’s DNS records to see if the sending server’s IP address matches one of the allowed IP addresses. SPF verifies the domain from the email’s Return-Path (also known as MAIL FROM, Envelope From, or bounce address), which might not match the domain displayed in the From address visible in the email client. This means that, similar to DKIM, scammers can spoof the From address and still pass an SPF check.

DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on DKIM and SPF to ensure that emails come from the specified domain in the From field and to set rules for handling those that don’t: - The domain owner publishes a DMARC DNS record, instructing receiving servers how to handle messages that fail SPF and DKIM checks. - When an email arrives, the recipient checks the DMARC record and verifies DKIM and SPF. If either passes and aligns with the From domain, DMARC passes. Otherwise, the message may be rejected or quarantined.