SPF, DKIM, and DMARC Explained Simply

Every day, billions of emails are sent with forged sender addresses. SPF, DKIM, and DMARC are three protocols that work together to prevent this email spoofing. Here's how they work in plain language.

SPF (Sender Policy Framework) is like a guest list for your domain. It's a DNS record that says: 'Only these specific mail servers are authorized to send email from my domain.' When a receiving server gets an email claiming to be from your domain, it checks the SPF record to verify the sending server is on the list.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. Think of it as a tamper-proof seal. The sending server signs the email with a private key, and the receiving server verifies it using a public key published in DNS. If anyone modifies the email in transit, the signature breaks.

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together with a policy. It tells receiving servers: 'If an email fails both SPF and DKIM checks, here's what to do with it.' Options are: monitor only, quarantine (send to spam), or reject outright.

Why does this matter for email aliases? When GhostRelay forwards email from your alias, the forwarded message needs to pass these checks at the receiving end (your real inbox). Without proper authentication, forwarded emails would land in spam.

GhostRelay solves this by re-signing forwarded emails with its own DKIM keys and setting proper SPF records. The email arrives at your inbox with valid authentication, even though it was forwarded through an intermediary.

Here's the flow: Original sender → their mail server (signed with their DKIM) → GhostRelay's servers (re-signed with GhostRelay's DKIM) → your inbox (verifies GhostRelay's signature). The original sender information is preserved in the Reply-To header so you can still respond.

Without these protocols, anyone could send an email pretending to be your bank, your employer, or your government. They're invisible to end users but form the backbone of email trust on the internet.

You can check any domain's email authentication setup using tools like MXToolbox or Google's Check MX. A properly configured domain will show SPF: pass, DKIM: pass, and DMARC: pass in email headers.