0

If SPF is verifying against a set of IP records if the incoming email from a domain was sent from an authorized host piggybacking on the DNS and DKIM does touch the signature of the email and calculate another one based on DNS public key record and if signatures matches, the mail is flagged as authentic from the expected domain providing authenticity and integrity of the email, why do I need to implement DMARC as well?

Can you help me understand which additional risk I should consider or address with DMARC?

As far as I can see, the from header can't be spoofed and PASS by SPF and DKIM at the same time.

Improve this question
6
  • "... the from header can't be spoofed and PASS by SPF and DKIM at the same time" - The From header isn't even considered in case of SPF. Only the MAIL FROM information from the SMTP dialog is used, not the From field in the mail header.
    – Steffen Ullrich
    Apr 23, 2021 at 10:54
  • 1
    Does the first paragraph from DMARC.org answer you?
    – schroeder ♦
    Apr 23, 2021 at 10:58
  • the point while domain can't be spoofed and SPF records are managed by domain owner, why adding DMARC as overhead while the email from fake_address@my_domain can't be sent to a legit_user@my_domain?
    – Asian Flavor
    Apr 23, 2021 at 11:42
  • @AsianFlavor: Again, SPF does not check the From field in the mail header, while DMARC does. Since checking the From field is expected to detect spoofing one need to have DMARC.
    – Steffen Ullrich
    Apr 23, 2021 at 14:18
  • @SteffenUllrich With SPF, the email can't originate from other mail server except the ones that I set so. Or do I miss something in SPF configuration?
    – Asian Flavor
    Apr 23, 2021 at 15:26

0

Reset to default

Browse other questions tagged .