Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC) are two protocols that email senders can use to assure email recipients that senders are who they claim to be. SPF publishes a record that authorizes domains of sending hosts. Recipients then verify the email senders against the authorized hosts. DMARC publishes a policy that indicates that their messages are protected by SPF or DKIM or both. The DMARC policy also tells recipients what to do if both of these authentication methods fail.

In the Email Security.cloud portal (ClientNet) on the Services > Email Services > Anti-Spam > Detection Settings tab, you can enable SPF and DMARC options separately, though SPF verification is part of DMARC. The following table summarizes the interactions between the DMARC and the SPF options.  A PDF version of this matrix is also attached for separate reference.

#

Sender SPF hardfail (-)

Sender DMARC policy

ClientNet Enabled SPF/DMARC

ClientNet Action
SPF/DMARC

SPF/DMARC Auth
Result = Failed

Expected
Email Verdict

Comment/
Action taken

1

True

True

True / True

Block / Quarantine

Fail / Fail

ClientNet DMARC Action

Quarantine

2

True

False (P=None)

True / True

Block / Quarantine

Fail / Fail

ClientNet SPF Action

Blocked

3

True

True

True / False

Redirect / Off

Fail / Fail

ClientNet SPF Action

Redirected

4

True

False (P=None)

True / False

Quarantine / Off

Fail / Fail

ClientNet SPF Action

Quarantine

5

True

True

False / True

Off / Block

Fail / Fail

ClientNet DMARC Action

Blocked

6

True

False (P=None)

False / True

Off / Tag subject

Fail / Fail

Sender DMARC Policy

SPF Logged

7

False

True

True / True

Redirect / Append

Fail (Softfail) / Fail

ClientNet DMARC Action

Append

8

False

False (P=None)

True / True

Quarantine / Block

Fail (Softfail) / Fail

Sender DMARC Policy

Pass Thru - SPF Result Softfail

9

False

True

False / True

Off / Senders policy

Fail (Softfail) / Fail

ClientNet DMARC Action

Quarantine As Set In DNS

10

False

False (P=None)

False / True

Off / Senders policy

Fail (Softfail) / Fail

Sender DMARC Policy

Pass Thru - SPF Result Softfail

11

False

True

True / False

Append / Off

Fail (Softfail) / Fail

Sender DMARC Policy

DMARC Logged

12

False

False (P=None)

True / False

Append / Off

Fail (Softfail) / Fail

Email Pass Thru

Pass Thru - SPF Result Softfail

13

True

True

True / True

Block / Append

Fail / Fail

ClientNet DMARC Action

Append

14

True

False (P=None)

False / False

Off / Off

Fail / Fail

Sender DMARC Policy

SPF Logged

15

True

True

False / False

Off / Off

Fail / Fail

Sender DMARC Policy

DMARC Logged

16

True

True

True / True

Block / Append

Pass / Fail

Email Pass Thru

DMARC, SPF, DKIM -  Pass

17

True

True

True / False

Append / Off

Pass / Fail

Email Pass Thru

SPF, DMARC - Pass, DKIM - Fail

18

True

True

True / True

Block / Senders

policy

Pass / Fail

Email Pass Thru

DKIM, DMARC - Pass, SPF - Fail

19

True

False (P=None)

False / False

Off / Off

Pass / Fail

Email Pass Thru

Pass Thru

20

True

True

False / False

Off / Off

Pass / Fail

Sender DMARC Policy

DMARC Logged

21

True

True

True / True

Block / Append

Pass / Fail

ClientNet DMARC Action

Append

22

True

True

True / False

Append / Off

Pass / Fail

Sender DMARC Policy

DMARC Logged

23

True

True

True / True

Block / Senders policy

Pass / Fail

Sender DMARC Policy

DMARC Blocked

24

True

False (P=None)

False / False

Off / Off

Fail / Pass

Email Pass Thru

Pass Thru - DMARC Check Pass, P=None Check Not Performed.

25

True

True

False / False

Off / Off

Fail / Pass

Email Pass Thru

Pass Thru

26

True

True

True / True

Block / Append

Fail / Pass

Email Pass Thru

Pass Thru

27

True

True

True / False

Append / Off

Fail / Pass

ClientNet SPF Action

Append

28

True

True

True / True

Block / Senders policy

Fail / Pass

Email Pass Thru

Pass Thru

 

 

SPF-DMARC Settings Matrix for Email Security.cloud

EmailSecurity_SPF-DMARC-Settings-Matrix.pdf

Thanks for your feedback. Let us know if you have additional comments below. (requires login)

    © 1995-2019 Symantec Corporation