Email Authentication Standards

The unifying policy layer that ties SPF and DKIM together. Domain owners publish p=none, p=quarantine, or p=reject so receivers know what to do when authentication fails, and request aggregate (rua) and forensic (ruf) reports. Without DMARC, receivers apply their own heuristics inconsistently.

A DNS TXT record listing which IPs and servers may send mail for your domain. Receivers check the connecting IP and apply the qualifier (-all, ~all, ?all, +all). SPF hard-caps at 10 DNS lookups — exceeding it causes PermError and can silently break delivery.

A reporting channel for SMTP transport security. When senders fail to establish TLS with your mail server — expired certificates, protocol mismatches, or MTA-STS enforcement — they send a JSON report to the rua destination in the _smtp._tls DNS record. Transport failures that would otherwise stay invisible become visible.

Lets a domain require TLS for inbound SMTP. A _mta-sts DNS TXT record points senders to an HTTPS policy file listing allowed MX hosts and mode (testing, enforce, none). In enforce mode, mail is delivered over TLS only — blocking STARTTLS downgrade and MITM attacks.

Preserves authentication results through forwarders and mailing lists that would otherwise break DMARC. Intermediate servers cryptographically seal original results so the final receiver can trust forwarded mail instead of rejecting it blindly.