SPF and DKIM are email authentication controls that help verify whether a message was sent by an approved server and whether its content was altered in transit. SPF checks sending IP addresses against domain-authorized mail sources, while DKIM uses cryptographic signatures tied to the sending domain to support trust and reduce spoofing.
What SPF and DKIM Actually Do
spf and dkim are complementary email authentication checks. SPF helps the receiving mail system confirm that a sending server is allowed to send for a domain, while DKIM helps confirm that the message was signed by the domain and has not been altered in transit.
Used together, they reduce the chance that a recipient will accept a forged message that only appears to come from a trusted domain. They do not, by themselves, guarantee that the sender is legitimate or that the message is safe to open.
Why Both Controls Matter
SPF is strongest at answering a network-origin question: does this sending IP belong to an approved mail source for the domain? DKIM is stronger on message integrity: was this message signed by the domain and preserved in transit? Because they answer different questions, one control can fail while the other still passes.
This separation is important in modern mail delivery. Forwarders, mailing lists, third-party senders and cloud mail services can complicate SPF evaluation, while DKIM can survive some relays but fail if the message body or selected headers are modified. A resilient email posture usually treats them as layered signals rather than interchangeable alternatives.
How They Support Domain Trust
When a domain publishes spf record and signs outbound mail with DKIM, receiving systems gain a verifiable basis for applying spam filtering, anti-spoofing decisions and domain-based policy checks. That improves domain reputation handling and supports downstream controls such as DMARC alignment.
In practice, the value of SPF and DKIM depends on accurate record management, consistent signing across legitimate senders and careful handling of third-party mail services. If a business adds new sending platforms without updating authentication settings, legitimate mail can fail checks or, worse, attackers can exploit gaps in coverage.
Common Failure Modes and Operational Limits
SPF can be weakened by stale DNS records, excessive include chains, or unapproved services sending on behalf of the domain. DKIM can fail when keys are rotated poorly, selectors are mismanaged, or intermediaries change content in a way that breaks the signature.
Neither control stops mailbox compromise, malicious internal sending, or abuse from a trusted account that already has permission to send mail. They are authentication and integrity controls for message delivery, not a full substitute for user awareness, tenant hardening, sender governance or fraud controls.
Risk and Threat Considerations
SPF and DKIM reduce spoofing risk, but they do not eliminate business email compromise, brand impersonation or abuse of compromised mail infrastructure. Attackers often target the human trust layer, knowing that a message from a seemingly valid domain can still carry malicious intent or fraudulent instructions.
Failure mechanism: A sender can abuse a misconfigured domain, compromised mail service, or weak third-party mail path to produce messages that appear authentic enough to pass basic trust checks.
Impact: Recipients may accept phishing, invoice fraud or impersonation attempts, and defenders may lose a key early warning signal if authentication is not consistently enforced.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle and protection of email authentication material used to establish trust. |
| SC-16 — Transmission Confidentiality and Integrity | Addresses integrity protection for information in transit, which DKIM helps support for email content. | |
| Recommendation — Manage signing keys and related authenticators so email trust material is rotated, protected and revoked on schedule. Protect message integrity in transit and validate that mail content has not been altered unexpectedly. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Applies when DKIM private keys or mail-sending secrets are exposed and enable spoofed mail. |
| NHI-07 — Long-Lived Secrets | Relevant because DKIM keys and mail-sending credentials should not remain valid indefinitely. | |
| Recommendation — Protect signing keys and mail-sending secrets so exposed credentials cannot be used to impersonate the domain. Rotate mail-authentication secrets regularly and shorten their lifetime where operationally possible. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Maps to the trust failure that occurs when a message is not correctly authenticated as authorised domain mail. |
| Recommendation — Verify email-authentication signals before treating a message as trusted or domain-authorised. | ||
| MITRE ATT&CK | T1566 — Phishing | SPF and DKIM are commonly used to reduce spoofing that supports phishing delivery. |
| Recommendation — Correlate spoofed-domain mail with phishing telemetry and harden detection around impersonation attempts. | ||
Practitioner Guidance
Why practitioners should care: Treat SPF and DKIM as baseline mail-authentication hygiene, not as a complete anti-phishing strategy. Their real value comes when they are deployed consistently across every legitimate sender and paired with an enforcement policy that reflects the organisation’s risk tolerance.
Practitioner note: The most common operational mistake is partial coverage, where one business unit, vendor or cloud mail platform is left outside the authenticated mail path. That gap creates both false negatives for legitimate mail and a spoofing opportunity for attackers.