SPF, DKIM, and DMARC — Are We Really Securing Email?

 

We have spent years implementing SPF, DKIM, and DMARC to improve email security. But I have a fundamental question.

 

What is the point of authenticating an email if the receiving server can deliver it even when authentication fails?

 

Let's look at what these technologies actually do.

 

- SPF verifies whether a sending server is authorized to send email for a domain.
- DKIM uses a digital signature to verify that selected message content has not been altered and identifies the signing domain.
- DMARC checks whether SPF or DKIM authentication aligns with the domain shown in the From address.

 

So far, so good.

 

But here is where things get interesting.

 

DMARC allows domain owners to publish three policies: `none`, `quarantine`, and `reject`.

 

Even when a domain owner specifies `p=reject`, the receiving mail server can still choose to accept and deliver the message.

 

Yes, you read that correctly.

 

The sender's domain can explicitly request rejection of messages that fail authentication, yet the receiving server has the final say.

 

Why?

 

Because email standards also try to protect legitimate messages that may fail authentication due to forwarding, mailing lists, or other technical complications.

 

In other words, the standards attempt to balance security with deliverability.

 

But that raises a serious question.

 

Are we building an email authentication system to enforce security, or are we building one that prioritizes delivering messages?

 

I understand the need to avoid rejecting legitimate email. But allowing authentication failures to be overridden means that authentication alone cannot guarantee protection against spoofing.

 

SPF, DKIM, and DMARC are valuable technologies. I am not suggesting we abandon them.

 

However, we should stop treating their implementation as proof that email is secure.

 

Authentication without consistent enforcement is not a security guarantee.

 

And that is something every email hosting provider and every business should understand.