DMARC requires either valid, aligned SPF or valid, aligned DKIM. That's how DMARC works. DKIM provides a way to verify signed email but doesn't enforce it, so it doesn't prevent spoofing alone, since it's not mandatory. SPF hardly does anything without DMARC due to alignment.
Conversation
Yes, I largely agree.
I’ve had SPF, DKIM, and DMARC configured on my domains for years.
The key word is “either” mei ONT that one (SPF) is sufficient for DMARC.
Should you have DKIM too? Yes.
Is DKIM technically required? I don’t think so.
1
I’d have to go back and re-read minutia of multiple RFCs.
But I’d rather exert less effort and use DKIM. Like I have done.
1
No one said DKIM is required. To prevent spoofing email from a domain to properly configured servers, only a DMARC p=reject policy is required. That requires that there is either valid, aligned DKIM or valid, aligned SPF. Lack of a DKIM / SPF setup will result in rejection.
1
If you want to extend the topic to actually sending email that passes DMARC, then sure, you can implement that with either SPF or DKIM instead of both. That's how DMARC works. However, if you only do SPF, you won't be able to send email via mailing lists / relays like with DKIM.
2
DKIM + DMARC is a lot more flexible because mails can be forwarded as usual, and it remains valid as long as there's no tampering with the email. A mailing list can still prepend List-Unsubscribe and other headers that aren't oversigned. DMARC with SPF only works directly.
2
1
If I configure DKIM and DMARC, I should _not_ have SPF records? Various (unauthoritative) sources had me convinced that I needed SPF as well.
I ran mailing lists for many years without problems (and without DMARC, DKIM, and SPF), but last year that became unworkable.
2
DMARC verification will pass with DMARC and DKIM set up properly. A DMARC policy with p=reject is fully compatible with mailing lists as long as they don't tamper with emails. Mailing list software should leave emails alone. They shouldn't tamper with signed headers / content.
2
1
1
Not if there is also an SPF record that rejects the mailing lists MTA and a DMARC policy that wants both SPF and DKIM to pass.
2
1
1
No, because that's not how SPF works. SPF does not require alignment with the FROM header. A hard fail SPF record permitting only your mail server is NOT incompatible with sending mail via a relay or list. SPF will pass based on MAIL FROM, which is why it doesn't stop spoofing.
1
1
1
Similarly, DKIM doesn't stop spoofing, because it doesn't have a way to mandate having an aligned DKIM signature. A spoofed email can have a valid DKIM signature that's not aligned, or no signature at all, and that's valid. DMARC requires that SPF or DKIM is valid AND aligned.
DMARC doesn't have a way to require that both SPF and DKIM are valid and aligned. It passes when either is valid or aligned. DKIM is the more important option because it's compatible with passing mail through other servers including mailing lists as long as they don't tamper.
1
1
1
You're overestimating the capability of SPF alone. If you set up a hard fail SPF policy permitting only your mail server without DMARC set up, someone can send a spoofed mail using your domain in the FROM address. They just have to use a valid MAIL FROM address (relay) to pass.
1
1
1
Show replies