Article
How email authentication works in Microsoft 365
learn.microsoft.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
How SPF, DKIM, and DMARC work together to authenticate email message senders “Internet domains need SPF, DKIM, and DMARC to work together for effective email authentication.” SPF: As explained in Set up SPF to identify valid email sources for your custom cloud domains, SPF uses a TXT record in DNS to: Identify valid sources of mail from the MAIL FROM domain. What to do if the destination email server receives mail from an undefined source ('hard fail' to reject the message; 'soft fail' to accept and mark the message). SPF issues: SPF validates sources for senders in the MAIL FROM domain only. SPF doesn't consider the domain in the From address or alignment between the MAIL FROM and From domains: An attacker can send email that passes SPF authentication (a false negative) by following these steps: Register a domain (for example, proseware.com) and configure SPF for the domain. Send email from a valid source for the registered domain, with the From email addresses in a different domain (for example, woodgrovebank.com). A legitimate email service that sends mail on behalf of other domains might control the MAIL FROM address. The other domains and the MAIL FROM domain don't match, so the messages can't pass SPF authentication (a false positive). SPF breaks after messages encounter server-based email forwarding that redirects or relays messages. Server-based email forwarding changes the message source from the original server to the forwarding server. The forwarding server isn't authorized to send mail from the original MAIL FROM domain, so the message can't pass SPF authentication (a false positive). Each domain and any subdomains require their own individual SPF records. Subdomains don't inherit the SPF record of the parent domain. This behavior becomes problematic if you want to allow email from defined and used subdomains, but prevent email from undefined and unused subdomains.
DKIM: As explained in Set up DKIM to sign mail from your cloud domain, DKIM uses a domain to digitally sign important elements of the message (including the From address) and stores the signature in the message header. The destination server verifies that the signed elements of the message weren't altered. How DKIM helps SPF: DKIM can validate messages that fail SPF. For example: Messages from an email hosting service where the same MAIL FROM address is used for mail from other domains. Messages that encounter server-based email forwarding. Because the DKIM signature in the message header isn't affected or altered during email forwarding or when a hosting service uses the same MAIL FROM address for multiple domains, these messages are able to pass DKIM. DKIM issues: The domain that DKIM uses to sign a message doesn't need to match the domain in the From address shown in email clients. Like SPF, an attacker can send email that passes DKIM authentication (a false negative) by following these steps: Register a domain (for example, proseware.com) and configure DKIM for the domain. Send email with the From email addresses in a different domain (for example, woodgrovebank.com). “When messages are automatically forwarded between domains or organizations, DMARC alignment can fail even for legitimate service senders.” ARC: As explained in Configure trusted ARC sealers, legitimate services that modify messages in transit can use ARC to preserve the original email authentication information of modified messages. How ARC helps DMARC: The destination email system can identify the service as a trusted ARC sealer. ARC can then use the preserved email authentication information to validate the message.
Internet domains need SPF, DKIM, and DMARC to work together for effective email authentication. “Identify valid sources of mail from the MAIL FROM domain.” DKIM: As explained in Set up DKIM to sign mail from your cloud domain, DKIM uses a domain to digitally sign important elements of the message (including the From address) and stores the signature in the message header. The destination server verifies that the signed elements of the message weren't altered. How DKIM helps SPF: DKIM can validate messages that fail SPF. For example: Messages from an email hosting service where the same MAIL FROM address is used for mail from other domains. Messages that encounter server-based email forwarding. Because the DKIM signature in the message header isn't affected or altered during email forwarding or when a hosting service uses the same MAIL FROM address for multiple domains, these messages are able to pass DKIM. DKIM issues: The domain that DKIM uses to sign a message doesn't need to match the domain in the From address shown in email clients. Like SPF, an attacker can send email that passes DKIM authentication (a false negative) by following these steps: Register a domain (for example, proseware.com) and configure DKIM for the domain. Send email with the From email addresses in a different domain (for example, woodgrovebank.com).
In SPF records
As an organization with cloud mailboxes, protecting the integrity of email messages from senders in your domains is important. Recipients should feel confident that messages from senders in your domain really came from senders in your domain. “Email authentication (also known as email validation) is a group of standards to identify and prevent the delivery of email messages from forged senders (also known as spoofing).” Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain.
Email authentication (also known as email validation) is a group of standards to identify and prevent the delivery of email messages from forged senders (also known as spoofing). Spoofed senders are commonly used in business email compromise (BEC), phishing, and other email attacks. These standards include: “Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain.” DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit.
Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain. “DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit.” Domain-based Message Authentication, Reporting and Conformance (DMARC): Specifies the action for messages that fail SPF or DKIM checks for senders in the domain, and specifies where to send the DMARC results (reporting).
DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit. “Domain-based Message Authentication, Reporting and Conformance (DMARC): Specifies the action for messages that fail SPF or DKIM checks for senders in the domain, and specifies where to send the DMARC results (reporting).” Authenticated Received Chain (ARC): Preserves original email authentication information by known services that modify messages in transit. The destination email server can use this information to authenticate messages that would otherwise fail DMARC.
Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.