Skip to main content
DNS & Email Security·1 min read

DNS Security Decoded: How SPF, DKIM, and DMARC Prevent Brand Impersonation & Spoofing

A practical guide to how DNS email authentication records safeguard company domains against executive spoofing, phishing, and domain hijacking.

TD
TrustDepth Security Lab
TrustDepth Security Research
DNS Email Authentication
SPF Record✓ v=spf1 Pass
DKIM Signature✓ Valid RSA
DMARC Policy✓ p=reject Active

Why the Original Email Protocol Lacked Authentication

When the Simple Mail Transfer Protocol (SMTP) was created in 1982, the internet was a network of trusted academic and government institutions. SMTP contained no mechanism to verify that the sender listed in the 'From:' header was actually the entity that transmitted the message.

Without additional DNS-level authentication protocols, an attacker anywhere in the world can send an email with the header 'From: billing@paypal.com' or 'ceo@yourcompany.com', and naive receiving mail servers will accept it.

The Three Pillars of Email & Domain Authentication

1. SPF (Sender Policy Framework): A DNS TXT record that explicitly publishes the IP addresses and mail servers authorized to send email on behalf of your domain.

2. DKIM (DomainKeys Identified Mail): A cryptographic signature attached to email headers that allows receiving servers to verify that the email body has not been altered in transit.

3. DMARC (Domain-based Message Authentication, Reporting & Conformance): The enforcement policy that instructs receiving mail servers what to do if an incoming message fails SPF or DKIM (e.g., 'p=reject' to immediately drop spoofed emails).

Checking DNS Health with TrustDepth

Every domain report on TrustDepth performs a real-time Cloudflare DoH lookup on A, MX, TXT, and NS records. Domains that publish strict DMARC policies and valid SPF records earn higher trust ratings because they actively protect their users and brand reputation against impersonation.

Frequently Asked Questions

What happens if a domain has no SPF or DMARC records?

Without SPF and DMARC records, anyone can send emails claiming to be from that domain (@company.com), making it trivial for scammers to execute Business Email Compromise (BEC) and impersonation attacks.

How does TrustDepth evaluate DNS security?

TrustDepth queries authoritative DNS servers via Cloudflare DoH to inspect A records, MX records, SPF TXT records, DMARC policy enforcement, and DNSSEC signature validity.

Related Security Guides