Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC) are two protocols that email senders can use to assure email recipients that senders are who they claim to be. SPF publishes a record that authorizes domains of sending hosts. Recipients then verify the email senders against the authorized hosts. DMARC publishes a policy that indicates that their messages are protected by SPF or DKIM or both. The DMARC policy also tells recipients what to do if both of these authentication methods fail.
In the Email Security.cloud portal (ClientNet) on the Services > Email Services > Anti-Spam > Detection Settings tab, you can enable SPF and DMARC options separately, though SPF verification is part of DMARC. The following table summarizes the interactions between the DMARC and the SPF options. A PDF version of this matrix is also attached for separate reference.
# |
Sender SPF hardfail (-) |
Sender DMARC policy |
ClientNet Enabled SPF/DMARC |
ClientNet Action SPF/DMARC |
SPF/DMARC Auth Result = Failed |
Expected Email Verdict |
Comment/ Action taken |
1 |
True |
True |
True / True |
Block / Quarantine |
Fail / Fail |
ClientNet DMARC Action |
Quarantine |
2 |
True |
False (P=None) |
True / True |
Block / Quarantine |
Fail / Fail |
ClientNet SPF Action |
Blocked |
3 |
True |
True |
True / False |
Redirect / Off |
Fail / Fail |
ClientNet SPF Action |
Redirected |
4 |
True |
False (P=None) |
True / False |
Quarantine / Off |
Fail / Fail |
ClientNet SPF Action |
Quarantine |
5 |
True |
True |
False / True |
Off / Block |
Fail / Fail |
ClientNet DMARC Action |
Blocked |
6 |
True |
False (P=None) |
False / True |
Off / Tag subject |
Fail / Fail |
Sender DMARC Policy |
SPF Logged |
7 |
False |
True |
True / True |
Redirect / Append |
Fail (Softfail) / Fail |
ClientNet DMARC Action |
Append |
8 |
False |
False (P=None) |
True / True |
Quarantine / Block |
Fail (Softfail) / Fail |
Sender DMARC Policy |
Pass Thru - SPF Result Softfail |
9 |
False |
True |
False / True |
Off / Senders policy |
Fail (Softfail) / Fail |
ClientNet DMARC Action |
Quarantine As Set In DNS |
10 |
False |
False (P=None) |
False / True |
Off / Senders policy |
Fail (Softfail) / Fail |
Sender DMARC Policy |
Pass Thru - SPF Result Softfail |
11 |
False |
True |
True / False |
Append / Off |
Fail (Softfail) / Fail |
Sender DMARC Policy |
DMARC Logged |
12 |
False |
False (P=None) |
True / False |
Append / Off |
Fail (Softfail) / Fail |
Email Pass Thru |
Pass Thru - SPF Result Softfail |
13 |
True |
True |
True / True |
Block / Append |
Fail / Fail |
ClientNet DMARC Action |
Append |
14 |
True |
False (P=None) |
False / False |
Off / Off |
Fail / Fail |
Sender DMARC Policy |
SPF Logged |
15 |
True |
True |
False / False |
Off / Off |
Fail / Fail |
Sender DMARC Policy |
DMARC Logged |
16 |
True |
True |
True / True |
Block / Append |
Pass / Fail |
Email Pass Thru |
DMARC, SPF, DKIM - Pass |
17 |
True |
True |
True / False |
Append / Off |
Pass / Fail |
Email Pass Thru |
SPF, DMARC - Pass, DKIM - Fail |
18 |
True |
True |
True / True |
Block / Senders policy |
Pass / Fail |
Email Pass Thru |
DKIM, DMARC - Pass, SPF - Fail |
19 |
True |
False (P=None) |
False / False |
Off / Off |
Pass / Fail |
Email Pass Thru |
Pass Thru |
20 |
True |
True |
False / False |
Off / Off |
Pass / Fail |
Sender DMARC Policy |
DMARC Logged |
21 |
True |
True |
True / True |
Block / Append |
Pass / Fail |
ClientNet DMARC Action |
Append |
22 |
True |
True |
True / False |
Append / Off |
Pass / Fail |
Sender DMARC Policy |
DMARC Logged |
23 |
True |
True |
True / True |
Block / Senders policy |
Pass / Fail |
Sender DMARC Policy |
DMARC Blocked |
24 |
True |
False (P=None) |
False / False |
Off / Off |
Fail / Pass |
Email Pass Thru |
Pass Thru - DMARC Check Pass, P=None Check Not Performed. |
25 |
True |
True |
False / False |
Off / Off |
Fail / Pass |
Email Pass Thru |
Pass Thru |
26 |
True |
True |
True / True |
Block / Append |
Fail / Pass |
Email Pass Thru |
Pass Thru |
27 |
True |
True |
True / False |
Append / Off |
Fail / Pass |
ClientNet SPF Action |
Append |
28 |
True |
True |
True / True |
Block / Senders policy |
Fail / Pass |
Email Pass Thru |
Pass Thru |
Thanks for your feedback. Let us know if you have additional comments below. (requires login)