Why the Original Email Protocol Lacked Authentication
When the Simple Mail Transfer Protocol (SMTP) was created in 1982, the internet was a network of trusted academic and government institutions. SMTP contained no mechanism to verify that the sender listed in the 'From:' header was actually the entity that transmitted the message.
Without additional DNS-level authentication protocols, an attacker anywhere in the world can send an email with the header 'From: billing@paypal.com' or 'ceo@yourcompany.com', and naive receiving mail servers will accept it.
The Three Pillars of Email & Domain Authentication
1. SPF (Sender Policy Framework): A DNS TXT record that explicitly publishes the IP addresses and mail servers authorized to send email on behalf of your domain.
2. DKIM (DomainKeys Identified Mail): A cryptographic signature attached to email headers that allows receiving servers to verify that the email body has not been altered in transit.
3. DMARC (Domain-based Message Authentication, Reporting & Conformance): The enforcement policy that instructs receiving mail servers what to do if an incoming message fails SPF or DKIM (e.g., 'p=reject' to immediately drop spoofed emails).
Checking DNS Health with TrustDepth
Every domain report on TrustDepth performs a real-time Cloudflare DoH lookup on A, MX, TXT, and NS records. Domains that publish strict DMARC policies and valid SPF records earn higher trust ratings because they actively protect their users and brand reputation against impersonation.