Three DNS records show up together on SY0-701, and most study material lists them as email authentication and then moves on. That grouping is what makes the questions hard, because the questions are almost always about the difference between them, and specifically about which one does the thing the other two cannot.
Here is the short version. SPF and DKIM both validate something the recipient never looks at. DMARC ties the check to the address displayed in the mail client.
SPF answers a narrow question: was this server allowed to send. It is a TXT record on your domain, and it lists the IP addresses and hosts that are permitted to send mail for it. A receiving server takes the message, looks at the sending IP, and compares it against that list.
The part that decides exam questions is which address SPF checks. It checks the envelope sender, the address in the MAIL FROM command, also called the Return-Path. That is not the From line your users read. The two are frequently different, and forwarding services break the connection between them on purpose.
Does SPF stop spoofing? No. A message can pass it cleanly and still display whatever the attacker wants in the From field. SPF was never designed for that.
DKIM answers something else. Was this message altered, and does the sender hold the key. The sending server signs a set of headers and the body with a private key and attaches the signature. The public key sits in DNS at selector._domainkey.yourdomain. The receiver pulls that key, verifies the signature, and now knows the message was not modified in transit and that whoever sent it holds the private key for that domain.
Also useful. Also not what people assume.
A valid DKIM signature tells you which domain signed the message. It does not require that domain to be the one in the From header, which means an attacker who controls a throwaway domain can sign their own spoofed message with their own key and have it verify perfectly. The signature is valid. The mail is still fake.
DMARC binds the check to the visible From. That record lives at _dmarc.yourdomain. It adds two things neither of the others has.
First, alignment. Why does that word matter so much here? Because DMARC requires that the domain in the From header, the one the human reads, matches the domain that passed SPF or DKIM. That single requirement is what turns two technical checks into a control that is very hard to spoof past.
Second, a policy. DMARC tells receiving servers what to do when alignment fails, using p=. Setting it to none means monitor only and deliver anyway. Quarantine means treat the message as suspicious, which in practice is the spam folder. Reject refuses it outright. A rua= address collects the aggregate reports that receiving servers send back to you.
So what does this look like on the exam? The scenario is usually some version of this. Employees are receiving messages that appear to come from an executive at their own company, asking for something urgent, and you have to say what should be implemented.
Both SPF and DKIM will sit there in the option list, and both of them are real controls that a real organization should absolutely have deployed, which is exactly why they work so well as distractors. Neither is the answer. Neither one acts on the address in that message. DMARC does.
The second common shape is a misconfiguration question. The organization has all three deployed, spoofed mail is still landing in inboxes, and you have to say why. The answer is usually p=none, which is monitoring rather than enforcement. Publishing a DMARC record and leaving the policy at none is very common in the real world, and it blocks nothing.
The deployment order is worth knowing even outside the exam, in order to understand why so many domains sit at p=none forever. Publish SPF and DKIM first. Then publish DMARC at p=none and leave it alone. Read the aggregate reports for a few weeks, because they will show you legitimate senders you forgot about, like the invoicing tool nobody remembers setting up. Every one of those breaks the day you move to reject if it is not aligned. After that comes quarantine, and only then reject.
That is the whole enforcement story, and it comes down to one tag in one record.
I run p=quarantine on my own domain for exactly that reason. Going straight to reject means finding out which of your own services was misconfigured by having your mail bounce.
The trap with this material is that it is easy to read and hard to apply, which is the general shape of Security+. You can recite what all three records do and still pick SPF on the spoofing question, because the question does not use the word alignment anywhere in it. It describes a symptom and expects you to work backwards to the control.
What fixes that? Reps on the scenario wording rather than more reading. Professor Messer covers this in his objectives series for free, and Jason Dion's banks are good for timed practice. I build practice for SY0-701 as well, so full disclosure on that one. If you want to see what the simulation style items look like without making an account, there is a free one here: https://secplusmastery.com/security-plus-pbq
Top comments (0)