Email authentication is the set of technical signals used to determine whether an email was legitimately sent and how much it should be trusted. This tag covers protocols like SPF, DKIM, DMARC, and ARC — explaining what they actually prove, where they fall short, and how they shape modern inbox decisions.
Email Authentication
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is often described as “the thing that stops spoofing.” That’s not quite right. DMARC doesn’t stop email from being sent. It doesn’t verify messages. And it doesn’t introduce any new authentication checks of its own. What DMARC does is
Email Authentication
DKIM (DomainKeys Identified Mail) doesn’t verify who sent an email. It verifies that the message hasn’t been altered since it was signed, and that a domain takes responsibility for its contents. Understanding DKIM means understanding what it proves — and what it deliberately ignores.
Email Authentication
SPF doesn’t verify who sent an email — it only confirms that a server was allowed to deliver it. That distinction explains why SPF passes during phishing, fails during forwarding, and can’t be treated as a trust signal on its own.
Email Authentication
Email authentication relies on SPF, DKIM, and DMARC — a set of interlocking systems — but most people misunderstand what they really do, and what they don’t protect.