Authentication
What SPF, DKIM, and DMARC Really Mean
Email authentication answers technical questions about permission, signing, and alignment. It helps, but it is not a lie detector. A phish can still use perfectly valid infrastructure.
SPF
SPF checks whether the sending server was allowed to send mail for the envelope-sender domain. In simple language: was this IP allowed to send for that transport domain?
SPF normally cares about the P1 or envelope sender, not the visible From address in the inbox.
DKIM
DKIM attaches a cryptographic signature to parts of the email. If the signature verifies, it strongly suggests those signed parts were not altered after the message left the signing system.
DKIM is about message integrity, not moral character. A malicious sender can still sign their own malicious mail correctly.
DMARC
DMARC asks whether SPF or DKIM aligns with the visible From domain. It also lets the domain owner publish a policy such as monitor, quarantine, or reject.
DMARC matters because it is closer to the identity a human sees in the inbox.
Why a Passing Result Does Not Mean the Email Is Safe
An attacker does not need to spoof a big brand directly to run a phishing campaign. They can use a fresh domain, configure it correctly, pass SPF, sign with DKIM, and still send credential lures from it.
- A message can pass SPF but still come from an unrelated domain.
- A message can pass DKIM but still lead to a fake login page.
- A message can pass DMARC and still be a scam if the attacker controls the whole sender domain stack.
How to Read the Results
| Result | What It Usually Means |
|---|---|
| Pass | The relevant technical check worked as expected. |
| Fail | The message did not meet the expected auth condition. |
| None / unknown | The relevant signal was missing, unavailable, or not conclusively present. |
| Skipped / not evaluated | EmailIntel did not run that check in the chosen rule profile or there was not enough input to do so. |