SPF, DKIM and DMARC are three complementary email authentication standards. Together they let a domain owner state which servers may send its mail, sign its messages, and tell receiving servers what to do with mail that fails these checks.

How it works

• SPF (Sender Policy Framework): a DNS record lists the servers allowed to send email for the domain.
• DKIM (DomainKeys Identified Mail): outgoing messages carry a cryptographic signature that receivers check against a public key published in DNS. DKIM survives forwarding better than SPF.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): a DNS policy tells receivers whether to accept, quarantine or reject mail that fails SPF and DKIM alignment, and asks them to send reports back.

A DMARC policy of “reject” gives the strongest protection against direct spoofing. DMARC reports also reveal unknown services that send mail in the domain’s name.

Why it matters for dark web monitoring

These controls stop criminals from sending mail that appears to come from the exact company domain. They do not stop lookalike domains, which is why attackers register near-identical names for phishing and invoice fraud. Strong email authentication on the real domain, combined with monitoring for lookalike and spoofed domains, covers both sides of domain spoofing.

Sources: NCSC: Email security and anti-spoofing, CISA: BOD 18-01, Enhance Email and Web Security