Sender Policy Framework (SPF) is an important authentication protocol used across the email industry to help prevent domain spoofing. However, there are a few limitations when SPF is used without DKIM and DMARC that prevent it from blocking domain spoofing effectively in isolation.
SPF limitations
Here are the limitations of using SPF without DKIM and DMARC:
- Forwarded messages typically cause SPF to fail authentication verification. This is because the forwarder’s SPF record most likely does not contain the original sender’s authorized IP addresses.
- Many senders either cannot or do not keep their SPF records up to date to authorize all sending IP addresses, which also includes authorized third parties that change over time.
- SPF verification is performed on the Mail From (MFrom) domain, which is not visible to the recipient.
- This means a fraudster can pass SPF authentication verification for a domain completely unrelated to the sending domain they are spoofing.
- The MFrom address is also referred to as the Envelope-Sender address, Return-Path address, and bounce address.
Mailbox provider impact
Mailbox providers understand the SPF limitations listed above and factor it into their spam filters. This helps ensure legitimate email reaches customers' inboxes. In order to help mailbox providers identify legitimate domain spoofing, you should also implement the DKIM and DMARC authentication protocols.
- DKIM complements SPF by using an alternative method of sender identification based on cryptography. SPF authenticates the sender, whereas DKIM authenticates the message itself and that it has not been altered in transit.
- DMARC utilizes DKIM and SPF to create an additional layer of security and sender identification.
- DMARC can provide instructions to a mailbox provider to block messages that fail SPF and DKIM authentication verification and have a DMARC record policy set to reject (p=reject). Part of the DMARC requirements involves the concept of domain alignment, so it makes it much more difficult for fraudsters to spoof the domain.
