Will This Email Get Through?

About this interactive

Email was built with no way to check who sent a message, so three checks were added on top of it, each published by the sending domain in its own DNS. SPF lists the servers allowed to send mail for the domain: IPv4 and IPv6 addresses, and include for a partner's servers. A message from a listed server passes. One from anywhere else meets the `all` at the end: ~all is a soft fail (let it in, but treat it as likely spam) and -all a hard fail (do not accept it). DKIM signs each message. The sending server hashes it and signs the hash with the domain's private key; the receiver fetches the public key from DNS and checks the signature. A match means the message came from that domain and was not changed on the way. A changed message, a forged signature or a missing key does not pass, and a signature hides nothing: anyone can still read the message. DMARC says what to do with mail that fails. Its policy is none (no special treatment), quarantine (treat it as suspicious) or reject, pct sets how much of the failing mail the policy covers, and rua says where to send aggregate reports. Every one of these is a request. The receiving server makes the final call.

What you'll learn

Predict the SPF result a receiving server reaches from a domain's SPF record and the address a message came from, including ip4, ip6 and include mechanisms, soft fail (~all) and hard fail (-all), and explain why the receiver still decides what to do
Predict whether a DKIM signature verifies when a message arrives unchanged, is changed on the way, is signed with the wrong key or a stolen one, or has no public key in DNS, and explain what DKIM does and does not protect
Predict what a DMARC record's policy (none, quarantine or reject), percentage and aggregate-report address ask a receiver to do with a message that fails both SPF and DKIM, and with one that passes both

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Sender Policy Framework: Sender Policy Framework is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, helping receiving servers identify and reject spoofed messages.
SPF Record: A DNS TXT record that specifies which mail servers are authorized to send email on behalf of a domain.
Hard Fail: An SPF qualifier (indicated by -all) that instructs receiving mail servers to reject messages that do not match any authorized sender in the SPF record.
Soft Fail: An SPF qualifier (indicated by ~all) that instructs receiving mail servers to accept but flag or mark as likely spam any messages that do not match an authorized sender in the SPF record.
DomainKeys Identified Mail: DomainKeys Identified Mail is an email authentication mechanism that uses asymmetric cryptography to sign outgoing messages, allowing receivers to verify that the email was not altered in transit and originated from an authorized sender.
Digital Signature: A cryptographic mechanism used to verify the authenticity and integrity of a digital message or document.
Public Key: A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key: A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Domain-based Message Authentication, Reporting, and Conformance: Domain-based Message Authentication, Reporting, and Conformance is an email authentication protocol that builds on SPF and DKIM to enable domain owners to specify how unauthenticated emails should be handled and to receive reports on message authentication activity.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.

Topics

Spf Dkim Dmarc Email Security Dns Spoofing Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →