# Why Email Authentication Matters: SPF, DKIM, DMARC and the 1980s Legacy Behind Spoofing

Ben Morin, 2026-08-05. https://bemorin.com/writing/email-authentication-spf-dkim-dmarc-anti-spoofing-guide

> Email was designed decades ago for trust-first networks, not hostile internet traffic. That legacy still enables impersonation unless you configure modern authentication layers. This guide gives you the practical model.

<h2>1) Why legacy email is vulnerable</h2>
<p>
  Core email protocols grew from standards in the 1980s era where sender identity checks were minimal. Attackers can still forge visible sender
  fields if domain-level policies are missing.
</p>

<h2>2) What spoofing looks like in real life</h2>
<ul>
  <li>fake invoices sent as if from your domain</li>
  <li>phishing campaigns abusing your brand name</li>
  <li>reputation damage from messages you never sent</li>
</ul>

<h2>3) SPF in one sentence</h2>
<p>
  <strong>SPF</strong> tells receiving servers which IPs/services are allowed to send on behalf of your domain.
</p>

<h2>4) DKIM in one sentence</h2>
<p>
  <strong>DKIM</strong> adds a cryptographic signature so receivers can verify message integrity and authorized signing domain.
</p>

<h2>5) DMARC in one sentence</h2>
<p>
  <strong>DMARC</strong> defines policy when SPF/DKIM checks fail and sends reports so you can monitor abuse and alignment quality.
</p>

<h2>SPF, DKIM, and DMARC compared</h2>
<p><strong>How the three layers differ</strong></p>
<table>
  <thead>
    <tr>
      <th scope="col">Layer</th>
      <th scope="col">What it proves</th>
      <th scope="col">Typical DNS</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <th scope="row">SPF</th>
      <td>Which hosts are allowed to send mail for your domain</td>
      <td>TXT (sender policy)</td>
    </tr>
    <tr>
      <th scope="row">DKIM</th>
      <td>Message was not altered in transit; ties to a signing domain</td>
      <td>TXT (selector records)</td>
    </tr>
    <tr>
      <th scope="row">DMARC</th>
      <td>What to do when SPF/DKIM do not align; reporting for monitoring</td>
      <td>TXT at <code>_dmarc</code></td>
    </tr>
  </tbody>
</table>

<h2>6) Safe rollout plan</h2>
<ol>
  <li>Publish SPF with all legitimate senders listed.</li>
  <li>Enable DKIM for each sender platform.</li>
  <li>Start DMARC with <code>p=none</code> to collect reports.</li>
  <li>Move to <code>p=quarantine</code>, then <code>p=reject</code> when confident.</li>
</ol>

<h2>7) Common mistakes</h2>
<ul>
  <li>forgetting one sender service in SPF records</li>
  <li>multiple SPF TXT records (invalid configuration)</li>
  <li>skipping DMARC monitoring before strict policy</li>
  <li>assuming one-time setup is enough without audits</li>
</ul>

<h2>8) Business impact</h2>
<p>
  Proper authentication improves deliverability, protects brand trust, and reduces support incidents caused by fake emails sent in your name.
  For founders, it is low-effort, high-leverage risk reduction.
</p>

<h2>Final takeaway</h2>
<p>
  Email security is not optional infrastructure anymore. The internet kept the old protocol DNA, so modern protection comes from SPF, DKIM,
  and DMARC done correctly and reviewed regularly.
</p>