<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-authentication-protocols
description: >-
  Implement and validate SPF, DKIM, DMARC, ARC, and MTA-STS records
  to prevent email spoofing and ensure sender authentication across enterprise
  email infrastructure.
domain: cybersecurity
subdomain: email-security
tags:
  - spf
  - dkim
  - dmarc
  - arc
  - mta-sts
  - dns
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1566.002"]
  tools: [dig, nslookup, opendkim-testkey, swaks, dmarcian]
---

# Implementing Email Authentication Protocols

## Overview

Email authentication protocols form the foundation of email security.
SPF validates sender IP authorization, DKIM provides cryptographic
message signing, DMARC aligns SPF/DKIM with policy enforcement, ARC
preserves authentication across forwarding, and MTA-STS enforces TLS.

## Prerequisites

- Tools: dig, opendkim-testkey, swaks, dmarcian
- DNS administrative access for TXT record management
- Understanding of RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC)

## Key Concepts

- **SPF**: Sender Policy Framework — DNS TXT record listing authorized sender IPs
- **DKIM**: DomainKeys Identified Mail — cryptographic signature on message headers
- **DMARC**: Domain-based Message Authentication, Reporting & Conformance — policy layer
- **ARC**: Authenticated Received Chain — preserves auth results across forwards
- **MTA-STS**: Mail Transfer Agent Strict Transport Security — TLS enforcement

## Workflow

### Step 1: SPF Record Validation

```bash
# Query existing SPF record
dig TXT example.com +short | grep "v=spf1"

# Validate SPF syntax — check for +all (dangerous)
# Good: v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all
# Bad:  v=spf1 +all

# Check SPF DNS lookup count (max 10)
python3 -c "
import subprocess
result = subprocess.run(['dig', 'TXT', 'example.com', '+short'], capture_output=True, text=True)
spf = [r for r in result.stdout.split(chr(10)) if 'v=spf1' in r]
for s in spf:
    includes = s.count('include:') + s.count(' a ') + s.count(' mx ')
    print(f'Lookup mechanisms: {includes}/10')
"
```

### Step 2: DKIM Key Generation and Testing

```bash
# Generate DKIM key pair (2048-bit RSA minimum)
opendkim-genkey -s selector1 -d example.com -b 2048

# Publish public key in DNS
# selector1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIj..."

# Validate DKIM key in DNS
opendkim-testkey -d example.com -s selector1 -vvv

# Verify DKIM signature on received message
opendkim -t < message.eml
```

### Step 3: DMARC Staged Deployment

```bash
# Phase 1: Monitor only
# _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-rua@example.com"

# Phase 2: Quarantine at 25%
# _dmarc.example.com TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-rua@example.com"

# Phase 3: Reject
# _dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc-rua@example.com"

# Query current DMARC policy
dig TXT _dmarc.example.com +short
```

### Step 4: MTA-STS and ARC Configuration

```bash
# Publish MTA-STS policy
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt

# Expected content:
# version: STSv1
# mode: enforce
# mx: mx.example.com
# max_age: 604800

# Publish DNS record
# _mta-sts.example.com TXT "v=STSv1; id=20260318000000"

# Verify ARC headers on forwarded messages
grep -E "^ARC-(Seal|Message-Signature|Authentication-Results):" headers.txt
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| SPF failures | Email gateway | Messages failing SPF from authorized senders |
| DKIM signature invalid | Email gateway | Broken DKIM signatures on legitimate mail |
| DMARC policy changes | DNS monitoring | Unauthorized DMARC record modifications |

```yaml
title: DMARC Policy Failure on Expected Domain
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects emails failing DMARC from domains expected to pass
logsource:
  category: email
  product: exchange
detection:
  selection:
    dmarc.result: "fail"
  condition: selection
falsepositives:
  - Mail forwarding services that break DKIM alignment
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
```

## Verification

- [ ] SPF record published with -all or ~all enforcement
- [ ] DKIM 2048-bit key pair generated and DNS record validated
- [ ] DMARC deployed in staged rollout with aggregate reporting
- [ ] MTA-STS policy published and enforcing TLS
- [ ] DMARC aggregate reports analyzed for alignment failures

## References

- [SPF RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208)
- [DKIM RFC 6376](https://datatracker.ietf.org/doc/html/rfc6376)
- [DMARC RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)
- [MTA-STS RFC 8461](https://datatracker.ietf.org/doc/html/rfc8461)
