SPF/DKIM/DMARC Email Path Tracer

About this interactive

SPF, DKIM and DMARC are usually taught as a list of three acronyms, and the list survives contact with almost no real question. The details that decide whether a message is delivered are the ones the list leaves out: a domain with no SPF record produces `none`, which is not `fail`; SPF reads the envelope sender, which nobody is ever shown, and not the From: header, which is the only sender anybody sees; a DKIM signature dies the moment a mailing list appends a footer, with no attacker and no misconfiguration anywhere; a plain forward breaks SPF and leaves DKIM untouched; and a marketing platform can pass both checks flawlessly as itself and still fail DMARC, because DMARC is not asking whether something passed but whether the thing that passed is the domain in the From: header. This activity traces ten messages through a receiving server and asks you to call each verdict before it shows you, ending with the one thing an attacker who owns his own domain and publishes his own DNS still cannot forge.

What you'll learn

Trace a message through the SPF, DKIM and DMARC checks a receiving mail server runs, and name the identifier each one authenticates
Distinguish the SPF and DKIM result values from one another - none, pass, fail and softfail - and predict which one a given DNS record and connecting host produce
Predict a DMARC disposition from an alignment result and a published policy, including p=none, p=quarantine and p=reject, relaxed versus strict alignment, and the walk to the organizational domain

Aligned to

CompTIA Security+

4.5 Given a scenario, modify enterprise capabilities to enhance security.

CompTIA A+ Core 1

2.6 Compare and contrast common network configuration concepts.

CompTIA SecurityX

2.4 Given a scenario, implement appropriate controls to secure communications and collaboration solutions.

Key terms

Sender Policy Framework: Sender Policy Framework is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, helping receiving servers identify and reject spoofed messages.
DomainKeys Identified Mail: DomainKeys Identified Mail is an email authentication mechanism that uses asymmetric cryptography to sign outgoing messages, allowing receivers to verify that the email was not altered in transit and originated from an authorized sender.
Domain-based Message Authentication, Reporting, and Conformance: Domain-based Message Authentication, Reporting, and Conformance is an email authentication protocol that builds on SPF and DKIM to enable domain owners to specify how unauthenticated emails should be handled and to receive reports on message authentication activity.
SPF Record: A DNS TXT record that specifies which mail servers are authorized to send email on behalf of a domain.
Text (DNS record): A DNS record type that holds arbitrary text data associated with a hostname, used for purposes such as domain verification, SPF email sender policy frameworks, DKIM public keys, and DMARC policies. TXT records allow domain owners to publish machine-readable configuration information in DNS.
Digital Signature: A cryptographic mechanism used to verify the authenticity and integrity of a digital message or document.
Public Key: A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key: A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Simple Mail Transfer Protocol: A TCP-based application-layer protocol used to send email messages between mail servers and from mail clients to outbound mail servers, typically on port 25 (server-to-server) or port 587 with TLS (client submission). SMTP only handles sending mail; retrieval is handled by separate protocols such as IMAP or POP3.
Mail Exchanger (DNS record): A DNS record type that specifies the hostname of the mail server responsible for accepting email messages on behalf of a domain. MX records include a priority value so that multiple mail servers can be configured with failover preference.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Mail Gateway: A security checkpoint positioned at the front of a mail system that filters inbound email through a series of checks, including allow/deny lists, authentication protocols, and anti-spam mechanisms, before passing messages to internal mail servers.
Quarantine: A disposition action taken by a mail gateway that isolates suspicious or high-scoring email messages for review rather than delivering them directly to the recipient or dropping them outright.
Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Business Email Compromise: An attack where a threat actor impersonates a trusted person within an organization via email to deceive employees, often by spoofing or compromising a legitimate email address.

Topics

Interactive Predict Spf Dkim Dmarc Email Security Dns Spoofing

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →