SPF, DKIM and DMARC email security checks

What CyberScan can establish

CyberScan observes MX, SPF and DMARC records and can look up a DKIM key when you supply the correct selector. It does not send a test email, inspect your inbox, verify every message’s alignment, analyse attachments or establish deliverability. A missing selector leaves DKIM untested; it is not evidence that DKIM is absent.

Compare the assessment routes and their coverage, or read how the current application handles data.

What does each control establish?

SPF lets a domain publish which sending systems are authorised for its envelope identity. DKIM allows a receiving service to check a message signature against a public key published under the signing domain. DMARC connects authenticated identities to the visible From domain and publishes a handling policy. A message needs successful aligned SPF or successful aligned DKIM to pass DMARC.

A DNS checker can observe published records. It cannot infer from their presence alone that a booking system, invoice service or newsletter is using the intended identity successfully. Ask the administrator to inspect received-message authentication results for each important sending service. Keep the sending identity and receiving result together in the evidence.

Sources: NCSC: Create and iterate an SPF record (opens in a new tab); RFC 6376: DomainKeys Identified Mail signatures (opens in a new tab); RFC 7489: DMARC (opens in a new tab)

Find the selector and map your senders

A DKIM selector identifies which DNS key to retrieve. Obtain it from the sending provider or the DKIM-Signature header of a signed message. Providers can use different selectors, so an unsuccessful lookup for one value does not describe every sender. Record the selector together with the signing domain and the service that uses it.

Include infrequent mail in your inventory: password resets, annual statements and website form notifications can be easy to miss. The NCSC recommends a phased approach to email security. Move towards enforcement using evidence from legitimate mail flows and continued monitoring, with an owner who can respond if a service fails. The time required depends on the organisation’s sending patterns and complexity.

Sources: NCSC: Create and manage a DKIM record (opens in a new tab); NCSC: Recommended email-security implementation plan (opens in a new tab)

Four practical steps

1. List legitimate senders. Record each provider, business owner, visible From domain, signing domain and DKIM selector. Include occasional and outsourced sending services.
2. Collect two kinds of evidence. Keep the DNS observation and an administrator’s received-message test. Record whether authentication and alignment worked for that specific sender.
3. Agree the policy change. Resolve legitimate failures with the providers. Use an approved change window, a contact for delivery problems and a documented rollback decision.
4. Check the result and keep monitoring. Retest published records and important mail flows. Review reports for new senders or failures and repeat the review when a provider changes.

Worked example: DMARC is present, but enforcement is not ready

Synthetic worked example. No domain or mail stream was tested to produce this illustration.

Email sender and evidence inventory

A blank CSV for legitimate services, sending identities, DKIM selectors, authentication evidence, owners and policy-change checks. Record references to evidence rather than copying private message contents.

Open in a spreadsheet application and replace the blank-entry rows with your own records. The template contains no findings, formulas or macros. Completing it does not upload it to CyberScan.

Common questions

Choose your next step

See the DNS observations and their limits, then verify your domain before running a public check.