KAGESecurity Lab

Threat Intel · 06 Oct 2026

SPF, DKIM and DMARC: a field guide

Three DNS records decide whether anyone can send email as your domain. What each one does, the common mistakes, and a safe rollout path.

← Threat Intel / Email

Kage Intel Team1 min readEmailDNSFundamentals

Email was designed without sender verification. SPF, DKIM and DMARC bolt it on through DNS, and together they decide whether a criminal can send mail that appears to come from your domain.

SPF — who may send

SPF is a TXT record listing the servers allowed to send mail for your domain.

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com -all"

Common mistakes:

  • More than 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including nested ones. Exceeding 10 causes a permerror and SPF fails entirely.
  • Multiple SPF records. Only one v=spf1 record is allowed per name.
  • Ending in +all or ?all, which authorises the whole internet.

DKIM — was the message altered

DKIM signs outgoing messages with a private key; the public key is published at selector._domainkey.example.com. Microsoft 365 uses selector1 and selector2; Google Workspace uses google by default.

DMARC — what to do on failure

DMARC ties SPF and DKIM to the visible From domain (alignment) and tells receivers what to do when both fail.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

A safe rollout path

  1. Publish p=none with a rua address and collect aggregate reports for a few weeks.
  2. Fix every legitimate sender that fails alignment.
  3. Move to p=quarantine, optionally with pct to ramp up.
  4. Finish at p=reject.

Run our free Email security check to grade your domain in seconds.

Related intel

Vulnerability4 min read Node2Shell (CVE-2026-111497): the Brotli flaw reaching Node.js, Python and beyond An out-of-bounds write in Google's Brotli decoder lets a single compressed HTTP request crash or potentially take over Node.js apps that accept Brotli bodies, including Express 5 by default. CISA lists it as exploited. What to patch, what else ships Brotli, and how to check. Vulnerability4 min read PHP2Shell (CVE-2026-109618, CVE-2026-109619): patch PHP now Two memory-safety bugs in the PHP engine allow unauthenticated remote code execution through ordinary web requests. Exploitation started within hours of disclosure and CISA has added both to KEV. What is affected, what to patch and how to hunt. Entra ID2 min read Defending Microsoft 365 against adversary-in-the-middle phishing AiTM kits proxy the real Microsoft sign-in page and steal the session cookie after MFA completes. Here is what actually stops them.