SPF, DKIM, and DMARC Auditing Explained

SPF, DKIM, and DMARC are three DNS-based records that together let mailbox providers verify an email actually came from who it claims to. Auditing them means checking that all three exist, are correctly formatted, and agree with each other — a common failure mode is having one record configured and the other two missing or misaligned.

SPF (Sender Policy Framework) lists which mail servers are allowed to send on behalf of a domain. DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail, proving it wasn't altered in transit. DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do when SPF or DKIM checks fail, and where to send reports about it.

• SPF — authorized senders, published as a domain TXT record
• DKIM — a per-message cryptographic signature, verified against a public key in DNS
• DMARC — the enforcement and reporting policy that ties the other two together

It's common to find a domain with SPF configured, DKIM configured, but no DMARC record at all — which means there's no policy telling receivers what to do when a spoofed email fails those checks, and no reporting to reveal that spoofing is happening. A DMARC record starting at `p=none` (monitoring only) is a safe first step before moving to `p=quarantine` or `p=reject`.

Aimly Audit validates SPF, DKIM, and DMARC together with DNS-level detail, rather than checking each in isolation — so a gap in one doesn't get missed because the other two look fine.