Question 1

What are SPF, DKIM and DMARC?

Accepted Answer

Three DNS-published records that together let a receiving mail server answer one question: **was this message really sent by the domain it claims to come from?** Email was designed with no sender authentication at all, and these were bolted on afterwards to address that.

**SPF (Sender Policy Framework).** A DNS TXT record listing **which servers are permitted to send mail for your domain**. The receiver checks whether the connecting server's IP appears in it.

**Its weakness:** SPF validates the **envelope sender**, not the visible From address, and it **breaks on forwarding** — a forwarded message arrives from a server not on the list.

**DKIM (DomainKeys Identified Mail).** The sending server **cryptographically signs** the message with a private key; the public key is published in DNS. The receiver verifies the signature, proving the message was signed by the domain **and has not been altered** in transit.

**Its weakness:** it proves the signing domain, which need not be the domain a human sees in the From line.

**DMARC.** The piece that makes the other two useful. It does three things:

**Alignment** — it requires that the domain validated by SPF or DKIM **matches the visible From domain**, closing the gap both leave open.

**Policy** — it tells receivers what to do when a message fails: `none` (monitor only), `quarantine` (spam folder), or `reject`.

**Reporting** — receivers send aggregate reports showing who is sending as your domain, which is how you discover both spoofing and your own forgotten systems.

**Why this is no longer optional.** Major mailbox providers now require authentication for bulk senders, and unauthenticated mail is increasingly rejected outright.

**The usual failure mode** is deploying `p=reject` before reviewing reports, which blocks legitimate mail from third-party senders — newsletter platforms, invoicing tools, booking systems — that nobody remembered were sending as the domain. **Start at `p=none`, read the reports, then tighten.**

Question 2

How does an email actually get delivered?

Accepted Answer

Through a chain of servers using SMTP, guided by DNS — and the important structural fact is that email is a store-and-forward system with no guarantee of delivery and no reliable confirmation of

Question 3

What is DNSSEC, and why isn't it everywhere?

Accepted Answer

DNSSEC adds cryptographic signatures to DNS records so a resolver can verify that an answer genuinely came from the domain's owner and was not altered in transit. It addresses a real weakness, and

Question 4

What do DNS record types like A, CNAME, MX and TXT actually do?

Accepted Answer

Each record type answers a different question about a domain, which is why a single domain has many records and why editing the wrong one breaks something unrelated. A — maps a name to an IPv4

Question 5

What is WHOIS, and why is most of it hidden now?

Accepted Answer

WHOIS is the long-standing public directory of domain registration details — and the information it once exposed has largely been withdrawn, primarily because of data protection law. What it

Question 6

What is the difference between a domain registrar, a DNS provider and a web host?

Accepted Answer

Three separate services that are frequently bought from one company and are entirely independent — and understanding the separation is what makes moving any of them possible without breaking the

Question 7

Who actually runs the internet?

Accepted Answer

Nobody, and several bodies with narrow remits — which is the accurate answer rather than an evasive one. There is no central authority; there are institutions that coordinate specific scarce

Related Questions