← Phishing Email Triage: From Message Evidence to Containment
1. Preserve and Read the Message
Start with Safe Handling and an Investigation Question Reconstruct Routing and Sender Identities
2. Authenticate and Analyze the Content
Interpret SPF, DKIM, DMARC, and Alignment Analyze URLs, Redirects, and Landing Evidence
3. Scope, Decide, and Contain
Triage Attachments Without Turning Analysis into Execution Scope Exposure, Choose a Disposition, and Write the Case
2. Authenticate and Analyze the Content

Interpret SPF, DKIM, DMARC, and Alignment

Use Authentication-Results correctly and avoid treating a pass or failure as a complete message verdict.

In this lesson, you will learn to:

  • Describe the identity and evidence evaluated by SPF and DKIM.
  • Determine whether DMARC alignment is satisfied and state the limits of the result.

Interpret SPF, DKIM, DMARC, and Alignment

Explains which identity each email authentication mechanism evaluates, how DMARC alignment works, and why forwarding and compromised senders create important edge cases.

Evaluate each mechanism against the correct identity

SPF asks whether the connecting host is authorized to use the evaluated SMTP MAIL FROM or HELO domain. It does not directly authenticate the user-visible From address. DKIM verifies a cryptographic signature over selected headers and the body using a public key published by the signing domain; a valid signature supports content integrity for the signed material and responsibility by that domain, not the identity of the human author. Read the receiver-stamped Authentication-Results field at the trusted boundary rather than a field inserted earlier by the sender.

DMARC evaluates the visible RFC 5322 From domain against authenticated domains. The message satisfies DMARC when at least one supported mechanism passes and its authenticated domain is aligned with the From domain under the applicable relaxed or strict rule. Record the evaluated domains, not only “pass” or “fail.” Also record temperror, permerror, none, and policy values accurately. A missing or failed result may reflect misconfiguration or message mediation; it is evidence to interpret, not a universal block rule.

SPF, DKIM, and DMARC test different claimsThe diagram separates connecting-host authorization, signed content, and alignment to the visible author domain.FIELD GUIDESPF, DKIM, and DMARC test different claimsSPF: MAIL FROMDKIM: signed domainDMARC: visible FromalignmentAnalyst: content andcontextAUTH SWIMLANE
SPF, DKIM, and DMARC test different claims — The diagram separates connecting-host authorization, signed content, and alignment to the visible author domain.

Combine alignment with context, not certainty

Authentication answers a narrow question: did infrastructure authorized by, or cryptographically associated with, an aligned domain participate in this message? A compromised legitimate mailbox or abused marketing platform can produce aligned passes while sending harmful content. Conversely, forwarding and mailing-list modification can break SPF or DKIM even when the original sender was legitimate. Authenticated Received Chain may preserve evidence across intermediaries in some environments, but its presence must be evaluated using the receiving platform’s trust configuration.

Use a decision sequence: validate that results were added by a trusted receiver; identify the SPF domain and result; identify every DKIM signature and result; compare passing domains with the visible From domain; read the DMARC result and policy; then compare the outcome with known sending patterns and message content. The conclusion should say exactly what passed, what aligned, and what risk questions remain. “DMARC passed” is never a synonym for “safe.”

Authentication becomes useful through alignment gatesTrusted receiver results, a passing mechanism, aligned domains, and contextual review lead to a bounded conclusion.FIELD GUIDEAuthentication becomes useful through alignment gatesTrusted resultSPF or DKIMpassesDomain alignsContext stillrequiredALIGNMENT GATES
Authentication becomes useful through alignment gates — Trusted receiver results, a passing mechanism, aligned domains, and contextual review lead to a bounded conclusion.

Resources

  • IETF RFC 7489: DMARC — Read the standard’s identifier-alignment and evaluation model to understand what a DMARC pass establishes.
← Previous: Reconstruct Routing and Sender Identities Next: Analyze URLs, Redirects, and Landing Evidence →