The limitations of an SPF check
The Sender Policy Framework (SPF) is an email authentication technique that is used to prevent spammers and cyber criminals from sending messages on behalf of your domain name. SPF enables domain owners to publish an SPF record in the DNS that specifies which mail servers or IP addresses they use to send email. During SPF email authentication, a receiving mail server performs an SPF check to verify that the domain in the "envelope from" address in the email header matches a valid IP address in the SPF record. If the addresses don't match, the email fails the SPF test and the email can be rejected by the email receiver.
An SPF check has limitations, however. It doesn't work when messages are forwarded, and it does nothing to protect against attacks spoofing only the "header from" address (the address that's visible to users). Keeping SPF records updated as organizations change service providers and add mail streams can be difficult.
The email validation system DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on the SPF check protocol (as well as the DKIM signature protocol) to provide a more powerful defense against email spoofing. DMARC augments the SPF check process by letting receiving mail servers know whether a domain is protected by SPF and/or DKIM and provides instructions on how to treat messages that don't pass either of these authentication protocols.
While DMARC can help protect against email spoofing more effectively, it can be difficult and time-consuming to deploy without the right tools. For organizations that want to bolster their email security with DMARC authentication, Mimecast provides a simple and effective solution that reduces the time, effort and costs to deploy DMARC.
