How email proves who sent it

Email was designed in an era of trust. Out of the box, anyone can put any address in a message's From line, much as anyone can write any return address on an envelope. That's how phishing mail can look like it comes from your company.

Three DNS records, published by you, let receivers tell real mail from fakes.

The guest list: SPF

SPF is a list of the services allowed to send mail for your domain. When a message arrives, the receiver checks whether it came from a server on your list.

The wax seal: DKIM

DKIM is a signature your sending service stamps on each message. The receiver checks it against a public key in your DNS. A valid seal proves the message came through a service you set up, and wasn't changed on the way.

The instructions: DMARC

DMARC ties the two to the address people actually see, and tells receivers what to do when a message fails: deliver it anyway (p=none), send it to spam (p=quarantine), or refuse it (p=reject). It also asks receivers to send you reports, so you can see who's using your name.

Why all three

SPF and DKIM prove a message came from somewhere you approved. Only DMARC says what to do when it didn't. A domain with SPF and DKIM but DMARC at p=none still lets fakes through.

In healthcheck.email

"Can someone pretend to be you?" on your report answers exactly this. SPF, DKIM and DMARC on one page shows what each record looks like.