Both Records Passed.
The Domain Still Got Spoofed.
How to construct and read the actual DNS TXT records: SPF mechanisms and qualifiers, DKIM key syntax, and the DMARC alignment rules that decide whether a passing SPF and a passing DKIM actually stop spoofing. Distinct from MAILSCOPE, which analyzes these records against live headers rather than teaching the syntax itself; see the BEC & Phishing Response playbook for what to do when one of these checks fails.
Record Anatomy
Three TXT records, three different purposes: who can send, how to verify the message wasn't altered, and what to do when the first two disagree.
SPF, DKIM, DMARC — Real Syntax
SPF (TXT record on the sending domain) v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all ├── v=spf1 — protocol version, always required first ├── mechanisms (ip4/ip6/a/mx/include) — what sources are authorized to send └── qualifier + all — the catch-all: -all (fail, strict), ~all (softfail), ?all (neutral), +all (pass, avoid) DKIM (TXT record at selector._domainkey.domain.com) v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC... ├── v=DKIM1 — version ├── k=rsa — key type └── p= — the public key itself, base64-encoded; the matching private key signs outgoing mail DMARC (TXT record at _dmarc.domain.com) v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@domain.com; pct=100; adkim=s; aspf=r ├── v=DMARC1 — version ├── p= — policy: none (monitor only), quarantine (spam folder), reject (block outright) ├── rua= — aggregate report destination, where XML summaries get sent daily └── adkim / aspf — alignment mode: s (strict, exact domain match) or r (relaxed, subdomain allowed)
SPF Mechanisms & Qualifiers
What each piece of an SPF record actually authorizes.
MECHANISM
include:
Pulls in another domain's SPF record
The most common way SPF records grow past the DNS lookup limit. Used to authorize a third-party mail provider's own sending infrastructure without listing every IP by hand.
MECHANISM
a / mx
Authorizes the domain's own infrastructure
Authorizes the domain's A record or MX servers directly to send mail. Rarely needed when using a third-party mail provider, since the provider's own infrastructure is what's actually sending.
MECHANISM
ip4 / ip6
Authorizes specific IP ranges directly
Used for self-hosted mail infrastructure where the sending IPs are known and stable, rather than delegated to a provider's include.
MECHANISM
~all vs -all
The final catch-all decides the record's actual strictness
~all (softfail) marks unauthorized senders as suspicious but usually still delivers the message. -all (fail) is the hard stance that should back a mature deployment once false positives are ruled out.DMARC Alignment Rules
Alignment is the piece that actually stops spoofing. SPF and DKIM alone don't.
ALIGNMENT
Strict (s)
Exact domain match required
Requires the domain in the DKIM signature or the SPF check to exactly match the visible From domain, not a subdomain or a related domain.
ALIGNMENT
Relaxed (r)
The default when unspecified
Allows a subdomain match, which is more forgiving for legitimate multi-subdomain sending setups but also more exploitable by an attacker using a related subdomain.
RULE
DMARC Passes On Either Check
Not both
A message can fail SPF alignment and still pass DMARC on DKIM alignment alone, or vice versa. DMARC's actual requirement is that at least one of the two aligns.
WHY IT MATTERS
The Classic Spoofing Case
Two technical passes, one spoofed domain
SPF and DKIM can both technically "pass" for a completely unrelated domain while failing DMARC, because that domain doesn't align with the visible sender. Alignment is what closes this gap; SPF and DKIM alone don't.
Common Pitfalls
Records that look correct on inspection but don't actually protect the domain.
PITFALL
The 10 DNS Lookup Limit
Every include: costs a lookup
Exceeding SPF's 10 DNS lookup limit causes a permerror that can fail validation entirely, not just weaken it. Nested includes from multiple third-party providers add up faster than expected.
PITFALL
p=none Doing Nothing But Monitoring
Many domains never move past this
A DMARC policy set to
p=none generates reports but enforces nothing. It's a reasonable first step, not a finished deployment, and plenty of domains stop there indefinitely.PITFALL
DKIM Selector Rotation Breaking Validation
Timing matters during a key change
Rotating the signing key without leaving the old selector's record in DNS during the transition invalidates mail signed with the old key before DNS propagation catches up to the new one.
PITFALL
SPF And DKIM Without DMARC
Independent passes, no alignment requirement
Without DMARC, there's no alignment requirement tying SPF and DKIM together. Both can pass independently for a spoofed visible From address, and nothing stops the message from being delivered.