Open with table of contents

How DMARC relates to SPF and DKIM

Domain-based Message Authentication, Reporting & Conformance (DMARCDomain-based Message Authentication, Reporting & Conformance) verification requires that either Sender Policy Framework (SPFSender Policy Framework) or DomainKeys Identified Mail (DKIMDomainKeys Identified Mail) validation checks pass. This means that if domain owners publish a DMARC DNS record, they must also publish a valid SPF or DKIM DNS record.

When you enable DMARC verification and the Clearswift Gateway detects a DMARC DNS record for the sender’s domain, the Clearswift Gateway automatically carries out SPF and DKIM checks, even if you have these checks disabled in the Clearswift Gateway. If either an SPF or DKIM check passes (and the DMARC domain alignment checks pass), then DMARC verification passes.

When more than one Clearswift Gateway validation check triggers (for example, both DMARC and SPF trigger), the action taken by the Clearswift Gateway is the highest priority action assigned to the triggering validation checks. The priority order of actions is as follows (highest priority first):

• Reject Message
• Add Info & Deliver: Adds the X-msw-integration header to messages and delivers messages.
• Hold, Add Info & Deliver: Holds messages in the area that you specify in the Hold Junk Email in Message Area section (see step 4 in Configuring Spam Policy for more information on specifying message area), adds the X-msw-integration header to messages, and delivers messages.
• Hold in area: Holds messages in the area that you specify in the Hold Junk Email in Message Area section. See step 4 in Configuring Spam Policy for more information on specifying message area.

See also...

• Domain-based Message Authentication, Reporting & Conformance (DMARC)

• Configuring DMARC

• DomainKeys Identified Mail (DKIM)

• Sender Policy Framework Settings (SPF)

© 1995–2018 Clearswift Ltd.