Email is an essential tool in our lives, as well as being one of Evicertia's primary methods of communication, but it is also a common target for spam and fraud. To counter this, there are three important defences: SPF, DKIM and DMARC. These technologies work together to ensure that emails are authentic and secure. From verifying senders to digital signatures and security policies, these solutions are essential to protect our electronic communications and strengthen our email security.

Brief Introduction to SPF and DKIM

The first step in this help is to explain these email security measures in order to understand how they work.

What is SPF?

SPF (Sender Policy Framework) is a technique that helps prevent spam or fraudulent e-mail by verifying whether the mail server sending a message is authorised to do so on behalf of a specific domain. 

Step-by-step explanation:

1. An e-mail server receives a message from a sender, e.g. "usuario@midominio.com".
2. The recipient's server queries the SPF records for the domain "mydomain.com".
3. SPF records contain a list of mail servers that are authorised to send mail on behalf of "mydomain.com".
4. The destination server checks if the server sending the mail is on that list.
5. If it matches, the mail is considered legitimate and is delivered. If it does not match, it may be treated as spam or rejected.

(Flowchart of a domain verified by SPF)

What is DKIM?

DKIM (DomainKeys Identified Mail): is another technique that helps to guarantee the authenticity of emails by adding a digital signature to the message. 

Step-by-step explanation:

1. When a mail server sends a message, it creates a unique digital signature for that message using a private key.
2. The mail server adds this signature to the message header.
3. The destination server, which has the corresponding public key, can verify the signature.
4. If the signature is valid, the message is considered authentic and has not been altered in transit.

(Flowchart of a domain verified by DKIM)

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is like an email supervisor for a domain (such as "mydomain.com"). Think of it as a set of rules that the domain owner sets up to tell other mail servers how to handle emails that appear to come from their domain.

1. Rules Configuration: The domain owner (such as a company) configures specific rules in the DNS records of their domain. These rules indicate how emails impersonating your domain should be treated.
2. Receiving an Email: When a mail server receives an email claiming to be from that domain (such as "usuario@midominio.com"), it checks the DMARC rules that the domain owner has configured.
3. DMARC-based actions: DMARC tells the receiving mail server what to do with the email. You can do one of three options:
1. Accept Email: If the email complies with DMARC rules (such as having the correct SPF and DKIM signatures), the server delivers it to the inbox.
2. Mark as spam: If the mail does not comply with DMARC rules, the server may mark it as spam or put it in the junk mail folder.
3. Reject Email: En casos extremos, si el correo no cumple con las reglas de DMARC, el servidor puede rechazarlo por completo, evitando que llegue al destinatario