SPF allows servers to send for a domain.DKIM adds a cryptographic signature to verify that a message has not been changed and that it has been signed by the expected domain.
In brief….Ideally, SPF and DHIM should be deployed together, then DMARC applied. Neither of these alone constitutes a complete protection against usurpation.
Solution A….
SPF
SPF is a DNS policy that lists the sources authorized to issue emails for a domain.
Key points…
- Published in a TXT record
- Assessed from the field of the SMTP envelope
- Can fail in some Dingles
Solution B….
DKIM
DKIM signs some headers and content with a private key; the public key is published in the DNS.
Key points…
- Use a selector for the DKIM
- Better resists simple transfers if message is not changed
- Verifies the integrity and identity of the signatory domain
Comparative table….
| Criterion…. | SPF | DKIM |
|---|---|---|
| Mechanism | Authorization by IP address or source | Signature |
| DNS publication | A SPF record…. | One public key per selector…. |
| Protects against… | Unauthorized cargo…. | Alteration and usurpation of the signatory domain…. |
| Link to DMARC… | Can provide SPF alignment…. | Can provide, alignment with the DKIM…. |
Choose SPF if….
You must declare which services are entitled to, send for the domain….
Choose DKIM if….
Your email platform allows you to sign messages with DKIM….
Key takeaways
Ideally, SPF and DHIM should be deployed together, then DMARC applied. Neither of these alone constitutes a complete protection against usurpation.
Deepening the two notions….
← Back to all comparison…