✉️Security & DevOps⏱️ 15 min read•Updated October 2026

Email Authentication & Domain Security Architecture Runbook: SPF, DKIM, DMARC, BIMI & MTA-STS

Architectural engineering manual detailing enterprise email defense protocols: RFC 7208 SPF lookup flattening, OpenDKIM cryptographic signature rotation, RFC 7489 DMARC alignment and telemetry ingestion, BIMI verified brand indicators, and MTA-STS strict TLS transport enforcement.

#Email Security#SPF#DKIM#DMARC#DNS#DevOps#Deliverability

1. The Authentication Triad: SPF, DKIM & DMARC Interplay

Email protocol SMTP (RFC 5321) possesses no intrinsic cryptographic identity verification. Any client can transmit a packet claiming any RFC 5322 From address. Modern email infrastructure relies on three interlocking layers to authenticate origin, guarantee message body integrity, and enforce organizational policy.

Inspect Live SPF TXT Record with dig

dig +short TXT example.com | grep "v=spf1"

Extracts the authoritative SPF policy published at the domain apex.

Query DMARC Policy Record at the _dmarc Subdomain

dig +short TXT _dmarc.example.com

Verifies the published DMARC enforcement policy and reporting endpoints.

Protocol	RFC Standard	Validation Mechanism	Failure Mode
`SPF`	Validates sending server IP against published DNS whitelist	RFC 7208	SoftFail (~all) or HardFail (-all)
`DKIM`	Validates asymmetric cryptographic signature in header	RFC 6376	PermFail (Signature Mismatch)
`DMARC`	Enforces identifier alignment between From, SPF, and DKIM	RFC 7489	Reject, Quarantine, or None

2. SPF Architecture: Mechanisms, Qualifiers & The 10-Lookup Limit

RFC 7208 Section 4.6.4 dictates a strict ceiling: an SPF evaluation must not perform more than 10 DNS lookups across include, a, mx, ptr, and redirect mechanisms. Exceeding 10 lookups yields an immediate PermError, rendering the record invalid on major mail transfer agents including Google Workspace, Microsoft 365, and Cloudflare.

Count DNS Lookups in Nested SPF Tree

# Count include mechanisms directly in terminal
dig +short TXT example.com | tr " " "\n" | grep -E "^(include|a|mx):" | wc -l

Evaluates top-level mechanisms consuming from the 10-lookup quota.

Flatten SPF Records using Netblock CIDRs

# Replace dynamic third-party includes with explicit static IP blocks
v=spf1 ip4:198.51.100.0/24 ip4:203.0.113.4/32 -all

Directly specifies CIDR subnets to reduce DNS lookup overhead to zero.

Mechanism / Prefix	Syntax Example	DNS Cost	Operational Impact
`include`	include:_spf.google.com	1 Lookup (+ nested)	Evaluates third-party delegated SPF records
`ip4 / ip6`	ip4:192.0.2.0/24	0 Lookups	Zero-cost static whitelist; immune to lookup exhaustion
`a / mx`	a:mail.example.com	1 Lookup each	Resolves domain A or MX records; avoid on high-traffic apexes
`ptr`	ptr:provider.net	Multiple Lookups	Deprecated by RFC 7208; highly unreliable; DO NOT USE

3. DKIM Cryptography: RSA 2048, Ed25519 & Selector Rotation

DomainKeys Identified Mail (DKIM, RFC 6376) attaches a digital signature to the email header using public-key cryptography. Senders sign specific canonicalized headers (From, Subject, Date, Message-ID) and body hash with a private key. Receivers query the public key published at [selector]._domainkey.[domain] to verify authenticity.

Generate 2048-bit RSA DKIM Keypair with OpenDKIM

# Generate 2048-bit key (1024-bit is cryptographically deprecated)
opendkim-genkey -b 2048 -d example.com -s 202610 -v

# Inspect generated DNS TXT record snippet
cat 202610.txt

Generates private key 202610.private and formatted DNS TXT file 202610.txt.

Verify Published DKIM Public Key with dig

dig +short TXT 202610._domainkey.example.com

Confirms the public key token is actively propagated across DNS.

DKIM Parameter	Tag	Standard Value	Security Recommendation
`Version`	v=DKIM1	v	Mandatory protocol version marker
`Key Algorithm`	a=rsa-sha256 or ed25519-sha256	a	Minimum RSA 2048-bit; Ed25519 preferred where supported
`Selector`	[selector]._domainkey.domain	s	Use date-stamped selectors (e.g. s202610) to facilitate zero-downtime rotation
`Canonicalization`	c=relaxed/relaxed	c	Tolerates whitespace changes introduced by intermediate MTAs

4. DMARC Architecture: Identifier Alignment & RUA Telemetry

DMARC ties SPF and DKIM directly to the visible RFC 5322 From address that users see in email clients. A message only passes DMARC if at least one underlying protocol (SPF or DKIM) passes AND achieves identifier alignment with the From header domain.

Production Enforced DMARC Policy (p=reject)

# Host: _dmarc.example.com
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-rua@example.com; aspf=r; adkim=r

Rejects 100% of unaligned messages and delivers daily aggregate XML reports.

Simulate Live Inbound SMTP Transaction with swaks

swaks --to user@example.com --from test@example.com \
  --server mail.example.com --auth-user test@example.com

Tests server-side SMTP authentication and TLS handshake behavior.

DMARC Tag	Purpose	Values	Best Practice
`p`	Domain-wide enforcement policy	none \| quarantine \| reject	Start with p=none for discovery; transition to p=reject
`rua`	Aggregate XML telemetry reporting URI	mailto:reports@domain.com	Mandatory for visibility into deliverability and attack vectors
`aspf / adkim`	SPF and DKIM identifier alignment mode	r (relaxed) \| s (strict)	Relaxed (r) allows subdomains; Strict (s) requires exact domain match
`sp`	Subdomain enforcement policy override	none \| quarantine \| reject	Explicitly set sp=reject to protect organizational subdomains

5. Next-Gen Defenses: BIMI Brand Indicators & MTA-STS TLS Policies

While SPF, DKIM, and DMARC protect identity, advanced modern defenses address brand presentation (BIMI) and active Man-in-the-Middle (MitM) wiretapping during SMTP transmission (MTA-STS and DANE).

Publish BIMI DNS Record with SVG Indicator

# Host: default._bimi.example.com
v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

Renders verified organization logo in Gmail, Apple Mail, and Yahoo inboxes.

Query MTA-STS Policy Record

dig +short TXT _mta-sts.example.com
# Fetches HTTPS policy at: https://mta-sts.example.com/.well-known/mta-sts.txt

Enforces strict TLS 1.3 encryption across inter-server SMTP hops.

Modern Standard	DNS / HTTP Endpoint	Prerequisite	Security Benefit
`BIMI`	default._bimi.example.com	DMARC p=quarantine/reject + VMC Certificate	Displays verified logo in supported email clients
`MTA-STS`	_mta-sts.example.com + /.well-known/mta-sts.txt	Valid Public TLS Certificate	Prevents SMTP STARTTLS downgrade attacks (RFC 8461)
`TLS-RPT`	_smtp._tls.example.com	rua=mailto:tls-reports@domain.com	Reports TLS handshake failures and MITM tampering attempts