Reference
Email authentication (SPF, DKIM, DMARC)
These three DNS-based standards work together to make it harder to spoof a domain in the "From" address of an email.
SPF (Sender Policy Framework)
A DNS record listing which mail servers are authorized to send email on behalf of a domain. Receiving servers check the sending server's IP against this list.
v=spf1 include:_spf.example.com ~allDKIM (DomainKeys Identified Mail)
Adds a cryptographic signature to outgoing email, generated with a private key. The receiving server verifies it using a public key published in DNS, confirming the message wasn't altered in transit.
v=DKIM1; k=rsa; p=MIGfMA0GCSq...DMARC (Domain-based Message Authentication)
Builds on SPF and DKIM by telling receiving servers what to do when a message fails both — reject it, quarantine it, or just monitor and report.
v=DMARC1; p=reject; rua=mailto:[email protected]
Why this matters to you
Even with SPF, DKIM, and DMARC configured correctly, scammers can still use lookalike domains (like “paypa1.com”) that pass their own authentication checks. Always verify the actual domain, not just whether an email “looks” authenticated.