The three questions
| Mechanism | Question it answers | Where it lives |
|---|---|---|
| SPF | Is this SERVER allowed to send for the domain? | TXT record listing permitted sources |
| DKIM | Was this MESSAGE signed by the domain and unmodified? | Signature header + public key in DNS |
| DMARC | Do SPF/DKIM ALIGN with the visible From, and what should receivers do on failure? | Policy record + reporting addresses |
The interlock people miss: SPF checks the ENVELOPE sender (MailFrom), DKIM checks a header signature — DMARC is what ties either to the From address users actually see (alignment). Passing SPF on a look-alike envelope while spoofing the visible From is exactly what DMARC exists to kill.
The classic failures, mechanically
- The 10-lookup limit: SPF evaluation may cost at most 10 DNS lookups;
every
include:spends from the budget. Years of SaaS onboarding ("just add our include") silently tips domains into PermError — at which point SPF effectively stops evaluating and DMARC leans on DKIM alone. Audit with any SPF flattener/counter; fix by pruning dead vendors and preferring DKIM-based authentication for bulk senders. - The forwarding problem: forwarders break SPF (new sending server) and sometimes DKIM (footers/rewrites). ARC exists to carry the original verdicts across hops; Microsoft honours it from trusted forwarders. This is why DMARC failures spike from mailing lists — expected, budgeted, not an incident.
- DKIM in EXO specifics: enable per-domain (two CNAMEs to Microsoft's selectors), keys rotated via the admin surface — unsigned mail from a domain that HAS DKIM configured usually means the wrong outbound path (an app relaying somewhere that doesn't sign).
- Subdomain leakage: DMARC policy applies to subdomains via sp= — attackers love unprotected subdomains of protected apexes; set sp= deliberately.
The DMARC journey (the only safe order)
p=none + rua reporting → weeks of report reading (who legitimately sends
as you — the shadow-sender census every org is shocked by) → authenticate
or retire each source → p=quarantine (staged with pct= if nervous) →
p=reject. Skipping the census phase is how payroll's invoice service
stops delivering on a Friday. Inbound, Microsoft applies sender DMARC
policies within the EOP pipeline (protection module) — your OWN journey
protects your brand elsewhere.
What to watch (proofs)
- The records themselves, versioned: SPF lookup count, DKIM selectors resolving, DMARC policy + rua — snapshot quarterly; drift here is incident-precursor material.
- DMARC aggregate reports (any analyser): the sender census and the fail-source list — the artifact that gates each policy step.
Get-DkimSigningConfig(in the serv365 nightly scan): enabled state and key status per domain — the tenant-side half of the DKIM story.- One header read per week: Authentication-Results on a real inbound message — spf/dkim/dmarc verdicts and ARC when forwarded; fluency here is the troubleshooting superpower this module builds toward.