(In Simple Terms) What Are the Three Major Email Authentication Protocols?

The three major email authentication protocols are SPF, DKIM, and DMARC.

In simple terms:

• SPF checks whether an email was sent from an approved server.

• DKIM verifies that the email is legitimate and has not been altered.

• DMARC uses SPF and DKIM to help determine what should happen when an email fails authentication.

Together, these protocols help prevent attackers from impersonating your domain and make it easier for email providers to identify fraudulent messages.

Why Email Authentication Protocols Matter

Email was not originally designed with strong identity verification built in.

That creates a problem: attackers can sometimes send emails that appear to come from a legitimate company even though the company never sent them.

Email authentication helps receiving services such as Gmail, Outlook, and Yahoo determine whether a message claiming to come from your domain is actually legitimate.

For businesses, proper authentication can help:

• Reduce email spoofing

• Protect customers from phishing attempts

• Improve email deliverability

• Protect the company's reputation

• Give email providers more confidence in legitimate messages

The three primary technologies used to accomplish this are SPF, DKIM, and DMARC.

1. Sender Policy Framework (SPF)

Sender Policy Framework (SPF) tells email providers which servers are authorized to send email on behalf of your domain.

Think of SPF as an approved-sender list.

For example, imagine your company uses Google Workspace for email and Mailchimp for newsletters. Your SPF record can tell receiving email servers that both Google and Mailchimp are allowed to send messages using your domain.

If an email comes from an unauthorized server, the receiving provider may treat it as suspicious.

How Sender Policy Framework (SPF) Works

SPF information is published in your domain's DNS records.

When someone receives an email from your domain, their email provider checks the SPF record.

It essentially asks:

"Is this server authorized to send email for this domain?"

If the answer is yes, the email passes SPF.

If the answer is no, it may fail authentication.

SPF is useful, but it cannot fully prevent domain impersonation by itself. That is why it is normally used alongside DKIM and DMARC.

2. DomainKeys Identified Mail (DKIM)

DKIM adds a digital signature to outgoing email.

That signature allows the receiving email provider to verify two important things:

1. The message came from a server authorized to use the domain.

2. Important parts of the message were not changed after it was sent.

You can think of DKIM like a tamper-resistant seal on an email.

How DKIM Supports Domain Authentication

With DKIM, the sending email system creates a digital signature using a private cryptographic key.

A corresponding public key is stored in the domain's DNS records.

When the recipient's email provider receives the message, it uses the public key to verify the signature.

If everything matches, DKIM passes.

This adds another layer of domain authentication beyond simply checking which server sent the email.

3. Domain-Based Message Authentication, Reporting and Conformance (DMARC)

DMARC connects SPF and DKIM together and gives the domain owner more control over how suspicious messages should be handled.

It allows businesses to create a policy telling receiving email providers what to do when authentication fails.

Common options include:

• None: Monitor the email without taking action.

• Quarantine: Treat the email as suspicious, often sending it to spam.

• Reject: Block the message entirely.

This makes DMARC especially important for protecting a company's domain from impersonation.

How DMARC Strengthens Domain Authentication

DMARC does more than simply check whether SPF or DKIM passed.

It also checks whether the authenticated domain matches the domain shown to the person receiving the email.

This is known as domain alignment.

For example, an attacker may attempt to make an email appear to come from:

billing@example.com

DMARC helps email providers determine whether the systems that actually sent and signed the message are authorized to represent example.com.

If they are not, the DMARC policy can instruct the receiving provider to quarantine or reject the message.

How SPF, DKIM, and DMARC Work Together

The easiest way to understand the three protocols is to think of them as different security checks.

SPF: Is this sending server approved?

DKIM: Is this email properly signed and unchanged?

DMARC: Do SPF and DKIM support the domain shown to the recipient, and what should happen if authentication fails?

They work best together.

Using only one protocol leaves gaps that attackers may be able to exploit.

What Is BIMI?

BIMI, or Brand Indicators for Message Identification, allows participating email providers to display a company's verified brand logo next to authenticated emails.

For example, a properly authenticated marketing email may display the company's logo beside the sender name in supported inboxes.

BIMI is not one of the three primary email authentication protocols.

Instead, it builds on the email authentication system created by SPF, DKIM, and especially DMARC.

How BIMI Relates to Email Authentication

Organizations generally need a properly configured DMARC policy before they can take advantage of BIMI.

This makes BIMI another incentive for companies to strengthen their email authentication.

The basic progression looks like this:

SPF + DKIM → DMARC → BIMI

SPF and DKIM verify the email.

DMARC establishes the domain's authentication policy.

BIMI can then use that trusted foundation to help display the organization's brand identity in supported inboxes.

Authentication Protocols Do Not Encrypt Your Email

It is also important to understand what SPF, DKIM, and DMARC do not do.These protocols authenticate email. They do not necessarily encrypt the contents of the message.Their primary purpose is to help determine whether an email claiming to come from a particular domain is legitimate.

Encryption technologies address a different problem by protecting the contents of messages from unauthorized access.

Conclusion

The three major email authentication protocols are SPF, DKIM, and DMARC.

SPF verifies that the sending server is authorized. DKIM verifies the email using a digital signature. DMARC brings those checks together and tells email providers how to handle messages that fail authentication.

For businesses, properly configuring all three provides a much stronger defense against email spoofing, phishing, and domain impersonation.