On top of the excellent answer Mikael H wrote, I'd like to emphasize the nit-picking some more.
It is very important to understand that SPF and DKIM (and DMARC for that matter) are just a bunch of DNS text records. It is up to the receiving mail server to implement measures based on what it finds in these records and the results of the checks it is configured to perform.
Also, SPF and DKIM do not protect a receiving party against spoofing. In fact, SPF is checked against the email domain in the bounce address and DKIM is checked against the domain in the d=
value in the DKIM signature. Both fields are generally not visible to the recipient of an email, without combing through the actual headers of that email.
That means that both SPF and DKIM may pass, while not at all authenticating the spoofed domain. That is what DMARC aims to fix, the link between the email address that is shown in the email client (FROM
field) and the authenticated domain in the bounce address or DKIM d=
value.
So to answer your questions with this in mind:
A. Yes, they allow you to authenticate the domains you use to receive bounces on (SPF) and which your cryptographically sign for (DKIM). More and more ESPs check for DMARC alignment whether or not you publish such a record. Most definitely Office 365 works this way (check the authentication-results headers for dmarc=bestguesspass
). It influences the classification, it does not treat the emails as if there was a p=reject
policy published.
B. No. SPF will not protect your domain from being spoofed. If the FROM
address is [email protected]
and the bounce address is [email protected]
and spoofersdomain.com
lists the sending IP in their SPF record, SPF will pass. DMARC alignment will fail, however.
C. Emails are not being DKIM signed. Pretty common for Exchange Server on premise as DKIM signing is not a natively supported feature. In your DMARC reports, the DKIM result may show as none. However, in terms of DMARC it would show as failing (in the policy_evaluated
section of the XML
document).
All (regular, non DSN or forwarded) emails leaving your Office 365 tenant should be signed. If you haven't enabled DKIM for some of your domains, those emails will be signed by selector1-ourdomain-com._domainkey.ourdomain.onmicrosoft.com
.
D. Keeping in mind why DMARC is so important, the answer is No. DKIM signing authenticates the domain used in the DKIM signature (d=
). This can be an entirely different domain than used in the FROM
field that the recipient sees in his email client. DMARC ensures alignment between the domain used in the FROM
field and either the domain in the bounce address or the domain used to DKIM sign the message.
Also, a large part of the phishing schemes is spoofing the same domain as the recipient is in. CxO fraud is one of the most well-known examples.
I hope this helps you.