Phishing
Email Authentication Explained: SPF, DKIM, and DMARC
2026-06-28 · 8 min read
SPF declares which servers may send mail for your domain. DKIM cryptographically signs messages so recipients can verify integrity. DMARC ties both to a policy and tells receivers what to do when checks fail.
The most common gap is a DMARC record published with a policy of none. It produces reports but rejects nothing, which means spoofed mail using your domain still lands in inboxes.
Move deliberately: monitor with reporting first, review legitimate senders, then tighten toward quarantine and reject once your sending sources are fully mapped.
See this in your own environment
ShieldCore monitors the assets you own and tells you when something changes.
Keep reading
- What Security Posture Management Actually Tells YouA practical explanation of posture scoring, what it covers, and where it stops.
- Building an Asset Inventory That Stays CurrentWhy spreadsheets fail as inventories, and what continuous discovery changes.
- Shadow APIs and Why They PersistUndocumented endpoints are a documentation problem before they are a security problem.