Internet records
Chapter 13 / 18
Which name does email check?
The visible sender name may differ from the technical sender details.
Keep the three checks separate
SPF does not directly check the visible From line. DKIM checks a signature on signed data. DMARC needs at least one SPF or DKIM path that passes and aligns with From. Both do not have to pass.
It passed, but is the content safe?
A harmful sender using a real account can send valid email. DMARC pass does not say an attachment is safe. Read Received lines from bottom to top for the claimed route. Rely only on the part added by trusted systems; some lines may be forged.
Two paths for DMARC
Enlarge ↗Read as text
- SPF pass + alignment
- OR · DKIM pass + alignment
Same terms in both languages
Keep these words
- SPF
- Is the sending IP allowed for the envelope-sender or HELO domain?
- DKIM
- A domain signature tied to signed email data.
- DMARC
- Checks for an aligned SPF or DKIM pass for the visible From domain.
- Alignment
- The required match between the checked domain and the From domain.
A small example
Let’s do it together
From: [email protected]. DKIM passes with d=example.com. SPF fails. This example has a valid DMARC policy and trusted check results.
Identify example.com as the From domain.
The DKIM domain is also example.com: the signature passes and aligns.
DMARC can pass in this example. Check the attachment and message separately.
Close the notes. Think first.
Your turn
SPF passes without From alignment. DKIM fails. Does DMARC pass?
Read the explanation
No. A path must both pass and align. SPF pass alone is not enough.
Reading record
Only on this browser. These marks are not test results.Sources
I used my study notes and wrote new practice examples. The source PDF is not distributed here.
About the sources and rights