With DMARC I can set the policy to rejct mail. But isn’t it the same I can do with -all from within a SPF?

Same goes for quarantine and a softfail ~all.

Beside the reporting where is the benefit using DMARC on top of SPF?


With DMARC you can tell how the recipient should handle for both DKIM and SPF. It's also the only way to tell that DKIM is available and required, as DKIM in itself only applies to mail already signed with it.

SPF protects your domain from being used on the SMTP protocol level as the envelope sender, but the recipient only sees the headers the SPF doesn't protect. The envelope sender might get recorded in the Return-Path header, but most users only ever sees the From: and thinks the email is coming from that address. Only DKIM enforced with DMARC can protect the From header.

Because SPF+DMARC and DKIM+DMARC protects against different kind of forgery, you should have them both. Also, your DMARC alignment can tell that the message can be unsigned with DKIM as long as the SPF passes and that the SPF doesn't need to pass for DKIM signed messages. This becomes handy when you have more than one use cases for a single mail domain.

  • I thought SPF is checking the header from. Didn’t know it is checking the envelop from. Now it makes a little bit more sense, even if I haven’t fully understood yet. Will read more. Thanks! – Gordo2019 Feb 24 at 9:03
  • It's good to configure these all on both ends, at least as a practice. Then you'll see and learn in detail what really happens and what problems may arise from misconfiguration. – Esa Jokinen Feb 24 at 9:13
  • I am just a web developer with a manged server. No IT guy. Unfortunately I can’t do this on my server. DKIM hasn’t much spread sadly. – Gordo2019 Feb 24 at 9:43

SPF only specifies which addresses are authorized to send mail for your domain. It is up to the recipient to decide what to do with that information.

DMARC allows you to indicate exactly what actions you would like recipients to take when the SPF check fails.

These are not redundant, but complementary.

  • By RFC, -all should means to drop/discard the incoming email which does match it. The real difference mainly is what @EsaJokinen described (ie: envelope sender vs From: header). – shodanshok Feb 23 at 21:26
  • @shodanshok You need to read section 8 of that RFC. – Michael Hampton Feb 23 at 21:41
  • From 8.4: A "fail" result is an explicit statement that the client is not authorized to use the domain in the given identity. Disposition of SPF fail messages is a matter of local policy. So yes, an SMTP server can choose how to treat a matching fail (I used should for that reason, maybe it wasn't the best word...), but it give a very clear warning that often results in a) 550 error or b) an higher spam score (see appendix G). Its main drawback is that it only protect the envelope address; on the other hands, DMARC enable you to specify the policy for the From: header. – shodanshok Feb 23 at 22:33

TL;DR SPF alone can't protect you against exact-domain email spoofing. The DMARC is a must.

Here is a scenario, that passes your SPF's -all protection.

Let's assume you have a.com domain, and I own the b.com. I set up v=spf1 {myserversIP} -all TXT SPF record in b.com's DNS, and additionally install mail server on {myserversIP} host to use SMTP protocol to send emails. I use bounce@b.com as my envelope from address (which is Return-Path header on receiving side) and send email to someone by putting From: you@a.com in email's body. MDA receives my email and performs the following pseudo actions:

  1. Extracts domain from Return-Path: bounce@b.com
  2. Performs DNS lookup of b.com's SPF record, and gets v=spf1 {myserversip} -all
  3. Verifies sender's ip(aka my host's IP) against SPF IPs
  4. Marks email as authenticated and valid
  5. Congratulations. I have just send an email pretending to be you

So how to prevent this situation? The DMARC comes to rescue. DMARC adds an important new mechanism: alignment. With DMARC enabled, basically MDA performs the following pseudo actions after 3rd step:

  1. Checks From and Return-Path domains' alignment (b.com against a.com)
  2. Marks email as unauthenticated as the alignment failed
  3. Congratulations. DMARC prevented email spoofing.

That's it. Hope my answer make sense.

PS: I am a co-founder of all-in-1 DMARC deployment system. Every day I am dealing with lots of customers to explain the importance of DMARC, how it is the best industry standard nowadays to protect your domain against email spoofing and phishing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.