Securing your email with DMARC Email Authentication

First published: 24/10/2024, updated 24/10/25

Over the last few years, the occurrence of email fraud such as phishing and spoofing has been rising to such an extent that it is now a real threat to any organisation of any size. Securing and authenticating your email delivery has become essential and no longer optional.

Because the problem is becoming such an issue, providers such as Yahoo and Google are now enforcing DMARC verification to accept email from bulk senders.

Unfortunately, most small organisations are unaware of email authentication protocols, and these are often not configured, or mis-configured in their email system. This means your legitimate email could easily be going into your recipient’s junk folder and malicious actors could be sending spoof emails from your email domain without your knowledge.

What is Email Authentication?

My previous post described Advanced Threat Protection which focuses on threat protection on incoming email, Email Authentication is a process of confirming the identity of the sender and the legitimacy of emailed messages on outgoing email from your domain. Email authentication plays a critical role in any email-based business. It helps users distinguish legitimate emails from spam and phishing emails and limits the potential risk of cyberattacks.

How does Email Authentication Work?

It all starts with the implementation of one or more email authentication protocols. These are essentially a set of instructions that can help verify the authenticity of email messages and senders. These instructive policies need to be published by the email sender on their Domain Name System (DNS). See What is DNS?

When an email leaves the sender’s email server and is received by the receiver’s email server, a lookup is performed on the sender’s DNS to locate these published instructions. When located, the receiving email server follows these instructions to validate the sender and contents of the email. After validation, the receiver rejects, quarantines, or accepts the email as per the published instructions and status of authentication (fail/pass).

Authentication fail denotes that the sender is malicious, and the message isn’t originating from a trusted source or the one that it claims to be.

Email Authentication Standards

Email authentication standards are rules that govern how emails are created, sent, and received. These rules ensure that the messages we send and receive are secure and trustworthy. These standards can be used to protect against spoofing, malware, phishing, and other cyber threats.

What is SPF?

SPF (Sender Policy Framework) is a method that email servers use to determine if an email is legitimate and it helps prevent spoofing and phishing attacks.

When you send an email from your company’s domain name (e.g., engage-its.co.uk), the SPF record for that domain tells other mail servers which IP addresses are authorised to send messages on behalf of your domain. If someone tries to send an email from another IP address, the receiving server can reject it as fake because it doesn’t match the SPF record.

Read our What is SPF? Data sheet for more information.

What is DKIM?

DKIM ( DomainKeys Identified Mail) is a method of email authentication that allows senders to claim responsibility for their messages. It works by adding a digital signature to the message header. When the receiver gets an email with DKIM, they check the digital signature to make sure it is valid. If it is, then they know the message has remained unaltered during the transfer.

Read our What is DKIM? Data sheet for more information.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication system that protects your organisation’s domains from spoofing, phishing, and other cyber-attacks. It builds on the widely deployed email verification techniques, SPF and DKIM described above. For a message to be DMARC-approved, it must pass either SPF or DKIM authentication.

A DMARC policy essentially enables a domain owner to specify what to do in case an email fails both SPF and DKIM checks (i.e. whether to quarantine or reject it). The DMARC DNS record also specifies how the recipient can report back to the domain owner, in case an email fails authentication.

• An email is sent from business.com to receiver.com.
• receiver.com’s Mail Server looks up the SPF, DKIM, and DMARC records of business.com (on their DNS) to authenticate the sender.
• If the sender is authenticated, the email is delivered to the recipient.

DMARC’s reporting functionality provides visibility enabling you to identify who is sending emails on your behalf without your knowledge.

Why do you need a DMARC Policy? 

A DMARC policy can protect against a wide range of email-based attacks at your organisation. Email is the easiest way to use your brand for fraud. By using your domain and impersonating your brand, hackers can send malicious phishing emails to your own employees and customers. Not only will this compromise security in your organisation, but it can seriously harm your brand reputation.