CODEWITHSUNDEEP
emailspfdkimdmarc
zer0uno
zer0uno

Reputation: 8030

DMARC without SPF

Although it is not possible to implement a complete DMARC policy with only SPF, due to forwarded emails, is it still possibible to implement a proper DMARC policy with only DKIM?

Upvotes: 2

Views: 1115

Answers (1)

SnY
SnY

Reputation: 11

Yes, it's possible to protect an e-mail domain via DMARC policy solely with the DKIM digital signing technique in place.

The reason is that DMARC requires either SPF OR DKIM checks to pass, not necessarily both.

For more details see: https://datatracker.ietf.org/doc/html/rfc7489#section-2.1 or this similar question: https://serverfault.com/q/812367/268257

However such setup would limit DMARC policy protection only to "header From:" addresses that are typically visible to recipients.

To protect also the invisible "envelope sender" addresses (aka MAIL FROM or Return-Path), used for receiving bounces (Non-Delivery Reports), it's recommended to use the SPF, which is focused on that.

The SPF is also useful when sending emails to recipients that are lacking DMARC support as it gives them at least some hints about sender's authorization.

Thus the best setup is to combine both DKIM and SPF.

Upvotes: 1

Related Questions