Why Email Authentication Matters
Email is the #1 attack vector for Indian businesses. Without proper authentication, anyone can send emails pretending to be from your domain — to your customers, your employees, or your partners.
79%Of data breaches in India start with email (Verizon DBIR 2025)
62%Of Indian domains have no DMARC policy (Valimail Q4 2025)
₹1,200 CrLosses from email-based scams in India in 2025 (RBI Fraud Report)
3 recordsAll you need to protect your domain: SPF + DKIM + DMARC
The Email Authentication Trinity
graph LR
A[📧 Sent Email] --> B[SPF Check
Is sender IP authorized?] B --> C[DKIM Check
Is email signed?] C --> D[DMARC Policy
What to do if both fail?] D -->|Pass| E[📥 Delivered to Inbox] D -->|Fail| F[🗑️ Quarantine or Reject] style B fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style D fill:#1e3a5f,stroke:#10B981,color:#e2e8f0 style E fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Is sender IP authorized?] B --> C[DKIM Check
Is email signed?] C --> D[DMARC Policy
What to do if both fail?] D -->|Pass| E[📥 Delivered to Inbox] D -->|Fail| F[🗑️ Quarantine or Reject] style B fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style D fill:#1e3a5f,stroke:#10B981,color:#e2e8f0 style E fill:#1e5f3a,stroke:#10B981,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
SPF (Sender Policy Framework)
What it does: Declares which mail servers are allowed to send email on behalf of your domain.
How it works:
- You publish a DNS TXT record listing authorized senders
- Receiving servers check if the sending server's IP matches your SPF record
- If it doesn't match, the email fails SPF
dns
; Add this TXT record to your domain's DNS
yourdomain.com. TXT "v=spf1 include:_spf.google.com include:amazonses.com ~all"| Component | Meaning |
|---|---|
v=spf1 | This is an SPF record (version 1) |
include:_spf.google.com | Allow Google Workspace to send for you |
include:amazonses.com | Allow Amazon SES to send for you |
~all | Soft-fail everything else (use -all for hard fail) |
TIP
Start with
~all (soft fail) while testing. Once you're confident all legitimate senders are listed, switch to -all (hard fail) for maximum protection.Common SPF mistakes
| Mistake | Problem | Fix |
|---|---|---|
| Too many includes | SPF has a 10 DNS lookup limit | Consolidate or flatten |
Using +all | Allows ANYONE to send as your domain | Use -all or ~all |
| Missing a sender | Legitimate emails fail SPF | Audit all systems that send email |
| Multiple SPF records | Invalid — only one allowed | Merge into a single record |
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanDKIM (DomainKeys Identified Mail)
What it does: Cryptographically signs every email so receivers can verify it wasn't tampered with in transit.
How it works:
- Your mail server adds a digital signature to each outgoing email
- The public key is published in your DNS
- Receiving servers verify the signature using your public key
- If the signature is valid, the email passes DKIM
dns
; Your email provider gives you a DKIM record to add
selector._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."| Component | Meaning |
|---|---|
selector | Identifies which signing key (e.g., google, resend) |
v=DKIM1 | DKIM version 1 |
k=rsa | Key type (RSA) |
p=MIIBIj... | Your public key (base64 encoded) |
WARNING
Each email service needs its own DKIM record. If you use Google Workspace AND Resend AND Mailchimp, you need DKIM configured for each one with different selectors.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
What it does: Tells receiving servers what to do when SPF and DKIM fail, and sends you reports about email authentication results.
How it works:
- You publish a DMARC policy in DNS
- Receiving servers check SPF and DKIM results
- If both fail, the server follows your DMARC policy (none, quarantine, or reject)
- Servers send you aggregate reports about authentication results
dns
; Add this TXT record
_dmarc.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:ceo@bachao.ai; pct=100"| Component | Meaning |
|---|---|
v=DMARC1 | DMARC version 1 |
p=quarantine | Quarantine failing emails (alternatives: none, reject) |
rua=mailto:... | Send aggregate reports to this email |
pct=100 | Apply policy to 100% of emails |
DMARC policy progression
| Stage | Policy | Effect | When to Use |
|---|---|---|---|
| Monitor | p=none | No action, just reporting | First 2-4 weeks |
| Quarantine | p=quarantine | Failing emails go to spam | After reviewing reports |
| Reject | p=reject | Failing emails are dropped | Full confidence in setup |
Key Takeaway
The progression from p=none to p=reject is critical. Don't jump to reject immediately — monitor first, review reports, fix any legitimate senders that are failing, then gradually tighten the policy.
Verification: Check Your Domain Now
bash
# Check SPF
dig TXT yourdomain.com | grep "v=spf1"
# Check DKIM (replace 'selector' with your actual selector)
dig TXT selector._domainkey.yourdomain.com | grep "v=DKIM1"
# Check DMARC
dig TXT _dmarc.yourdomain.com | grep "v=DMARC1"Common Setup for Indian Businesses
Most Indian businesses use Google Workspace or Microsoft 365. Here's a quick reference:
Google Workspace
| Record | Value |
|---|---|
| SPF | v=spf1 include:_spf.google.com ~all |
| DKIM | Generate in Admin Console > Apps > Gmail > DKIM |
| DMARC | v=DMARC1; p=none; rua=mailto:your-email@yourdomain.com |
Microsoft 365
| Record | Value |
|---|---|
| SPF | v=spf1 include:spf.protection.outlook.com ~all |
| DKIM | Enable in Microsoft 365 Defender > Email authentication |
| DMARC | v=DMARC1; p=none; rua=mailto:your-email@yourdomain.com |
What Happens Without Email Authentication
| Scenario | Risk | Impact |
|---|---|---|
| No SPF | Anyone can send as your domain | Phishing emails to your customers |
| No DKIM | Emails can be modified in transit | Altered invoices, fake instructions |
| No DMARC | No policy enforcement | SPF/DKIM failures have no consequence |
| All three missing | Complete email impersonation | BEC attacks, fraud, reputational damage |
DANGER
Without all three records, an attacker can send emails that appear to come from your domain — to your customers, your bank, your partners. There is no technical barrier. SPF + DKIM + DMARC together close this attack vector.
Get Your Email Security Checked
INFO
Bachao.AI's VAPT scans include comprehensive email security assessment — SPF, DKIM, DMARC, and related DNS configurations are all checked and reported with specific fix instructions. Book a free scan to see how your email security stacks up.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Contact: ceo@bachao.ai. Follow me on LinkedIn for email security and cybersecurity insights for Indian businesses.
