SPF, DKIM, and DMARC: are your email controls actually aligned?

TL;DR: Email authentication fails most often when SPF, DKIM, and DMARC are configured inconsistently, because alignment, lookup limits, and missing reporting create blind spots that attackers can exploit for spoofing and deliverability abuse, according to Oneleet. The governance lesson is that authentication is a lifecycle control, not a one-time DNS task.

NHIMG editorial — based on content published by Oneleet: Engineering Email Authentication: SPF, DKIM, and DMARC

By the numbers:

• 17 minutes and as quickly as 9 minutes, cly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should organisations implement DMARC without breaking legitimate mail flow?

A: Start by inventorying every system that sends email for the organisation, then publish SPF and DKIM for each legitimate source.

Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?

A: They usually fail because identity is fragmented across systems.

Q: What do organisations get wrong about email spoofing protection?

A: They often assume authentication is a set-and-forget configuration.

Practitioner guidance

• Inventory every outbound mail stream Map newsletters, application notifications, support mail, and third-party sending services to the exact domain they use in SPF, DKIM, and DMARC.
• Start DMARC with monitoring and ownership Deploy v=DMARC1; p=none with rua reporting, assign a named owner for review, and track report trends for at least two full mail cycles before increasing enforcement.
• Fix SPF record hygiene before hardening policy Collapse multiple SPF records into one, stay under the 10 lookup limit, and verify the record sits on the correct domain for the actual Mail From flow.

What's in the full article

Oneleet's full blog covers the operational detail this post intentionally leaves for the source:

• Exact SPF, DKIM, and DMARC record patterns for common email service provider setups
• Stepwise guidance for moving from p=none to quarantine and then reject without disrupting legitimate mail
• Practical examples of DMARC alignment across Mail From and visible From domains
• Troubleshooting notes for DNS selector mistakes, lookup limits, and Cloudflare proxy interference

👉 Read Oneleet's guide to SPF, DKIM, and DMARC implementation details →

SPF, DKIM, and DMARC: are your email controls actually aligned?

Explore further

View Full Forum →  |  NHI Foundation Course →