A little overview of :

SFP (Sender Policy Framework)

DKIM (Domain Keys Identified Mail)

DMARC (Domain-based Message Authentication, Reporting & Conformance)


These are all related features built into DNS and the SMTP protocol and they are made to secure your email systems and to prevent spam and spoofing.

The primary function of all of these is to set policies for how the receiving end should treat your email if it does not comply to your defined standard.

The functions are not new, DMARC as an example was invented in 2012.

DMARC is using both SPF and DKIM to check the senders origin of an email, and the policy can be set to “none”, “quarantine” or “reject”

DMARC can also send reports to an email adress about which systems sendt from your domain and how they behaved in relation to your current SPF and DKIM settings, which are configured in DNS for the domain in question.

New in 2023 is that MS 365 will send DMARC reports and there is even a free report viewer that can be integrated in Azure portal, it’s named Valimail.

Valimail will give you better insights on how your domains are validating when sending email with methods SFP,DKIM and DMARC. It can also be used standalone, does not need to integrate in Azure portal.

SPF is simply a list of allowed senders from your domain.

It also contains switches advicing the receiver how to handle the email if the sender is not in the list.

(~all meaning softfail, can still be delivered, while -all means hardfail “drop if sender is not in this list”)

An SPF DNS record should not be longer than 255 chars. You can read more in RFC7208

DKIM is a DNS CNAME record pointing to a public key available on a primary mailhost, like MS 365.

It provides public key encryption for verification of the sending system. For more details see RFC6376

After DKIM is enabled , you can see in the received email’s header that it has been signed:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=testdomain.no;

You can check you DKIM public key by running a nslookup on the CNAME, and ofcource check all your related DNS records. A great toolbox is as always MXtools

The Norwegian security agency, NSM(nasjonal sikkerhjetsmyndighet) have created a list of recommendations for securing email, and there is lots of info available many places.

NSM guide can be downloaded here (in Norwegian)

Login AS can help you out if you need any help configuring this correctly.

Check your DNS records

By using nslookup whe can query the DMARC TXT record:


will return your record, that could start out looking like this:

“v=DMARC1; p=none; pct=100; rua=mailto:dmarc_agg@vali.email; fo=1”

Note that the policy is set to “none” in the above because we want to monitor what’s goint on before we activate quarantine or reject.

Look up your DKIM selector entry like this:


Allthough DKIM is a CNAME record, we want to query a TXT record in order to resolve the pub key. so:
set type=txt

the next query depends on your record, but the 365 records looks something like this:

The return should be the public key for your DKIM:

“v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BA


















More articles

Optional features

Check available optional features: DISM /Online /Get-Capabilities Install an optional feature: DISM /Online /Add-capability /capabilityname:Media.MediaFeaturePack~~~~

Read More »

AD retention period

Check AD retention tombstone value: Import-Module ActiveDirectory $ADForestconfigurationNamingContext = (Get-ADRootDSE).configurationNamingContext $DirectoryServicesConfigPartition = Get-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,$ADForestconfigurationNamingContext” -Partition $ADForestconfigurationNamingContext -Properties *

Read More »