SPF, DKIM, and DMARC: protecting an agency's email domain

Reference article · 5 min read

Email was built without a way to verify who sent a message. Anyone can put an agency's domain in the From line, and unless that domain publishes records saying which systems may send on its behalf, receiving servers have little basis for treating the forgery differently from the real thing. That is how residents end up with messages that appear to come from a utility billing office, a permit counter, or a police department but originated somewhere else.

SPF, DKIM, and DMARC are three DNS records that let a domain owner state which mail is legitimate and tell receiving systems what to do with everything else. The records cost nothing to publish. The work is finding every system that sends mail using the agency's domain, and there are usually more than anyone expects.

What each record does

SPF (Sender Policy Framework). A DNS record listing the servers and services permitted to send mail for the domain. SPF checks the envelope sender, the address bounces return to, not the From address the recipient sees.
DKIM (DomainKeys Identified Mail). The sending system signs each message with a private key whose matching public key is published in DNS. A verified signature confirms the message was authorized by the signing domain and was not altered along the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance). A policy record that ties the other two to the visible From address, tells receivers what to do with mail that fails, and asks them to send reports back to the domain owner.

Alignment is the part that surprises people

A message can pass SPF or DKIM and still fail DMARC. DMARC counts a pass only when the domain that authenticated matches the domain in the From header, the one the resident sees. That match is called alignment.

The usual example is a mass notification platform sending as the city. Bounces go to the vendor's own domain, so SPF passes for the vendor and not for the city, and nothing aligns. If instead the vendor signs with DKIM using a key the agency publishes in its own DNS, the signing domain matches the From address and the message passes DMARC. This is why DKIM delegation with vendors matters more than piling entries into an SPF record, which is also subject to a hard limit on the DNS lookups a receiver will perform before giving up.

Inventory before policy

Enforcement projects fail when a sender is missed. Before changing policy, list everything that sends as the domain:

The primary mail platform, and any legacy server still relaying.
Mass notification and emergency alerting systems.
Utility billing, permitting, licensing, court, tax, and recreation systems that email statements and reminders.
Agenda management, applicant tracking, work order, and newsletter tools.
Print and mail vendors, payment processors, and benefits administrators.
Copiers, alarm panels, and monitoring systems that send alerts.
Anything a department bought on its own and pointed at an agency From address.

Include parked and retired domains the agency still owns. A domain that sends no mail should publish records saying so, because attackers prefer unprotected domains.

Moving from monitoring to enforcement

Publish SPF and DKIM for the primary mail platform, and confirm ordinary staff mail passes both.
Publish DMARC with a policy of none and a reporting address. This asks receivers to change nothing and only to send reports.
Feed the aggregate reports into a processing tool or service. They arrive as XML and are impractical to read by hand.
Work the list. Bring each sender in the reports into alignment, preferably by publishing a DKIM key for it. Some vendors need only a support request. Some cannot align at all, and those should move to a dedicated subdomain, be replaced, or send from the vendor's own domain with a reply-to at the agency.
Move to quarantine once the only mail still failing is traffic the agency does not recognize. A percentage setting allows a gradual step.
Move to reject, and keep reading reports afterward.

Two cautions. Forwarding and mailing lists routinely break SPF while DKIM signatures usually survive, another reason to get DKIM right first. And set the subdomain policy explicitly, since subdomains otherwise inherit the parent policy.

What to ask vendors, and what to put in the contract

Ask every vendor that will send mail as the agency:

Can you sign with DKIM using a key we publish in our DNS, so the signing domain matches our From address?
What exact records do we publish, and how will you notify us before keys or sending infrastructure change?
Can you send from a subdomain we designate rather than the main domain?

In contracts and solicitations, require that any mail sent using agency domains authenticate in alignment with DMARC, that the vendor give advance written notice of changes affecting authentication, and that the vendor not send from the agency's primary domain if it cannot meet that requirement. Put these questions in security questionnaires so they surface before award.

What enforcement does not fix

DMARC protects the exact domain in the From header. It does nothing about lookalike domains registered to resemble the agency, a display name that reads like the city manager on a free webmail account, or a compromised staff account sending genuine authenticated mail. Those need account protection, inbound filtering, registration monitoring, and staff awareness.

Enforcement is also expected by others. Federal executive branch agencies operate under a binding operational directive requiring an enforcing policy, state programs and insurers ask about it on questionnaires, and large mailbox providers have added authentication requirements for bulk senders. These expectations change, so confirm current requirements with the issuing authority.

HQT works with state and local agencies on email authentication, sender inventory, and vendor coordination.

Frequently asked questions

Will enforcing DMARC block our mass notification or utility billing emails?

It will if those systems are not aligned when the policy changes, which is why the monitoring stage exists. Publish DMARC with a policy of none first, read the aggregate reports until every legitimate sender appears and passes in alignment, and only then move to quarantine and reject. Systems that cannot align should be moved to a dedicated subdomain or reconfigured to send from the vendor's domain with a reply-to at the agency.

How long does it take to get a city or county domain to DMARC enforcement?

The timeline depends almost entirely on how many systems send as the domain and how quickly their vendors respond, not on the DNS work itself. Agencies commonly spend several weeks or months in the monitoring stage identifying senders and getting each one aligned. The inventory step is where the time goes, so starting it early shortens the whole project.

Does DMARC stop spoofed emails that use a lookalike domain?

No. DMARC applies only to the exact domain in the From header, so a message sent from a similar but different domain is unaffected. Defending against lookalikes requires monitoring for newly registered similar domains, inbound filtering, and telling residents how the agency actually communicates.

What records should we publish for a domain that never sends email?

A parked or retired domain should still publish an SPF record that authorizes no senders and a DMARC record set to reject, so receivers discard anything claiming to be from it. Agencies often own old program domains and prior branding domains that are attractive to spoofers precisely because nobody is watching them. Include those domains in the same inventory as the active one.

Do we need a paid service to read DMARC reports?

Aggregate reports arrive as compressed XML from many different providers, so reading them by hand is impractical for anything but the smallest domain. Agencies generally use a reporting tool or hosted service to turn them into a readable list of senders and pass rates. Free and low-cost options exist, and the cost is usually small relative to the staff time it saves during the monitoring stage.