Article
How email authentication works in Microsoft 365
learn.microsoft.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
DKIM: As explained in Set up DKIM to sign mail from your cloud domain, DKIM uses a domain to digitally sign important elements of the message (including the From address) and stores the signature in the message header. The destination server verifies that the signed elements of the message weren't altered. How DKIM helps SPF: DKIM can validate messages that fail SPF. For example: Messages from an email hosting service where the same MAIL FROM address is used for mail from other domains. Messages that encounter server-based email forwarding. Because the DKIM signature in the message header isn't affected or altered during email forwarding or when a hosting service uses the same MAIL FROM address for multiple domains, these messages are able to pass DKIM. DKIM issues: The domain that DKIM uses to sign a message doesn't need to match the domain in the From address shown in email clients. Like SPF, an attacker can send email that passes DKIM authentication (a false negative) by following these steps: Register a domain (for example, proseware.com) and configure DKIM for the domain. Send email with the From email addresses in a different domain (for example, woodgrovebank.com). “When messages are automatically forwarded between domains or organizations, DMARC alignment can fail even for legitimate service senders.” ARC: As explained in Configure trusted ARC sealers, legitimate services that modify messages in transit can use ARC to preserve the original email authentication information of modified messages. How ARC helps DMARC: The destination email system can identify the service as a trusted ARC sealer. ARC can then use the preserved email authentication information to validate the message.
Internet domains need SPF, DKIM, and DMARC to work together for effective email authentication. “Identify valid sources of mail from the MAIL FROM domain.” DKIM: As explained in Set up DKIM to sign mail from your cloud domain, DKIM uses a domain to digitally sign important elements of the message (including the From address) and stores the signature in the message header. The destination server verifies that the signed elements of the message weren't altered. How DKIM helps SPF: DKIM can validate messages that fail SPF. For example: Messages from an email hosting service where the same MAIL FROM address is used for mail from other domains. Messages that encounter server-based email forwarding. Because the DKIM signature in the message header isn't affected or altered during email forwarding or when a hosting service uses the same MAIL FROM address for multiple domains, these messages are able to pass DKIM. DKIM issues: The domain that DKIM uses to sign a message doesn't need to match the domain in the From address shown in email clients. Like SPF, an attacker can send email that passes DKIM authentication (a false negative) by following these steps: Register a domain (for example, proseware.com) and configure DKIM for the domain. Send email with the From email addresses in a different domain (for example, woodgrovebank.com).
In SPF records
Email authentication (also known as email validation) is a group of standards to identify and prevent the delivery of email messages from forged senders (also known as spoofing). Spoofed senders are commonly used in business email compromise (BEC), phishing, and other email attacks. These standards include: “Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain.” DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit.
Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain. “DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit.” Domain-based Message Authentication, Reporting and Conformance (DMARC): Specifies the action for messages that fail SPF or DKIM checks for senders in the domain, and specifies where to send the DMARC results (reporting).
DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message remains unaltered in transit. “Domain-based Message Authentication, Reporting and Conformance (DMARC): Specifies the action for messages that fail SPF or DKIM checks for senders in the domain, and specifies where to send the DMARC results (reporting).” Authenticated Received Chain (ARC): Preserves original email authentication information by known services that modify messages in transit. The destination email server can use this information to authenticate messages that would otherwise fail DMARC.