How SPF and DMARC interact during Anti-Spam scanning in Email Security.cloud
DOC11288
Last Updated January 25, 2019
Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC) are two protocols that email senders can use to assure email recipients that senders are who they claim to be. SPF publishes a record that authorizes domains of sending hosts. Recipients then verify the email senders against the authorized hosts. DMARC publishes a policy that indicates that their messages are protected by SPF or DKIM or both. The DMARC policy also tells recipients what to do if both of these authentication methods fail.
In the Email Security.cloud portal (ClientNet) on the Services > Email Services > Anti-Spam > Detection Settings tab, you can enable SPF and DMARC options separately, though SPF verification is part of DMARC. The following table summarizes the interactions between the DMARC and the SPF options. A PDF version of this matrix is also attached for separate reference.
| # |
Sender SPF hardfail (-) |
Sender DMARC policy |
ClientNet Enabled SPF/DMARC |
ClientNet Action |
SPF/DMARC Auth |
Expected |
Comment/ |
| 1 |
True |
True |
True / True |
Block / Quarantine |
Fail / Fail |
ClientNet DMARC Action |
Quarantine |
| 2 |
True |
False (P=None) |
True / True |
Block / Quarantine |
Fail / Fail |
ClientNet SPF Action |
Blocked |
| 3 |
True |
True |
True / False |
Redirect / Off |
Fail / Fail |
ClientNet SPF Action |
Redirected |
| 4 |
True |
False (P=None) |
True / False |
Quarantine / Off |
Fail / Fail |
ClientNet SPF Action |
Quarantine |
| 5 |
True |
True |
False / True |
Off / Block |
Fail / Fail |
ClientNet DMARC Action |
Blocked |
| 6 |
True |
False (P=None) |
False / True |
Off / Tag subject |
Fail / Fail |
Sender DMARC Policy |
SPF Logged |
| 7 |
False |
True |
True / True |
Redirect / Append |
Fail (Softfail) / Fail |
ClientNet DMARC Action |
Append |
| 8 |
False |
False (P=None) |
True / True |
Quarantine / Block |
Fail (Softfail) / Fail |
Sender DMARC Policy |
Pass Thru - SPF Result Softfail |
| 9 |
False |
True |
False / True |
Off / Senders policy |
Fail (Softfail) / Fail |
ClientNet DMARC Action |
Quarantine As Set In DNS |
| 10 |
False |
False (P=None) |
False / True |
Off / Senders policy |
Fail (Softfail) / Fail |
Sender DMARC Policy |
Pass Thru - SPF Result Softfail |
| 11 |
False |
True |
True / False |
Append / Off |
Fail (Softfail) / Fail |
Sender DMARC Policy |
DMARC Logged |
| 12 |
False |
False (P=None) |
True / False |
Append / Off |
Fail (Softfail) / Fail |
Email Pass Thru |
Pass Thru - SPF Result Softfail |
| 13 |
True |
True |
True / True |
Block / Append |
Fail / Fail |
ClientNet DMARC Action |
Append |
| 14 |
True |
False (P=None) |
False / False |
Off / Off |
Fail / Fail |
Sender DMARC Policy |
SPF Logged |
| 15 |
True |
True |
False / False |
Off / Off |
Fail / Fail |
Sender DMARC Policy |
DMARC Logged |
| 16 |
True |
True |
True / True |
Block / Append |
Pass / Fail |
Email Pass Thru |
DMARC, SPF, DKIM - Pass |
| 17 |
True |
True |
True / False |
Append / Off |
Pass / Fail |
Email Pass Thru |
SPF, DMARC - Pass, DKIM - Fail |
| 18 |
True |
True |
True / True |
Block / Senders policy |
Pass / Fail |
Email Pass Thru |
DKIM, DMARC - Pass, SPF - Fail |
| 19 |
True |
False (P=None) |
False / False |
Off / Off |
Pass / Fail |
Email Pass Thru |
Pass Thru |
| 20 |
True |
True |
False / False |
Off / Off |
Pass / Fail |
Sender DMARC Policy |
DMARC Logged |
| 21 |
True |
True |
True / True |
Block / Append |
Pass / Fail |
ClientNet DMARC Action |
Append |
| 22 |
True |
True |
True / False |
Append / Off |
Pass / Fail |
Sender DMARC Policy |
DMARC Logged |
| 23 |
True |
True |
True / True |
Block / Senders policy |
Pass / Fail |
Sender DMARC Policy |
DMARC Blocked |
| 24 |
True |
False (P=None) |
False / False |
Off / Off |
Fail / Pass |
Email Pass Thru |
Pass Thru - DMARC Check Pass, P=None Check Not Performed. |
| 25 |
True |
True |
False / False |
Off / Off |
Fail / Pass |
Email Pass Thru |
Pass Thru |
| 26 |
True |
True |
True / True |
Block / Append |
Fail / Pass |
Email Pass Thru |
Pass Thru |
| 27 |
True |
True |
True / False |
Append / Off |
Fail / Pass |
ClientNet SPF Action |
Append |
| 28 |
True |
True |
True / True |
Block / Senders policy |
Fail / Pass |
Email Pass Thru |
Pass Thru |
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe
Subscribed to the Article.
Unable to subscribe
Thanks for your additional feedback !!!
Enterprise Support Virtual Agent
Rate Me :
Tell us more:
Welcome! My name is Sami, the Enterprise Support Virtual Agent answering technical support questions.
Start Over
This will clear the history and restart the chat.
Thanks for your feedback. Let us know if you have additional comments below. (requires login)