SPF, DKIM, DMARC configured for all sending domains
Why it matters
CAN-SPAM §5(a)(1) prohibits falsified routing information; proper SPF, DKIM, and DMARC configuration is how receiving servers verify that routing headers are accurate. Gmail and Yahoo's 2024 bulk sender requirements mandate SPF and DKIM authentication plus a DMARC policy for senders sending more than 5,000 emails per day — without it, bulk sends are rejected or spam-foldered at the domain level. CWE-290 (Authentication Bypass by Spoofing) applies: without DMARC, anyone can spoof your sending domain, sending phishing emails that appear to come from your business. NIST SP 800-53 SC-8 (Transmission Confidentiality and Integrity) covers the integrity dimension.
Severity rationale
Info because authentication failures primarily cause deliverability problems and phishing exposure rather than direct legal violations — but without DMARC, domain spoofing is trivially easy and Gmail bulk sender rejection blocks all marketing email.
Remediation
Configure SPF, DKIM, and DMARC DNS records for your sending domain. Follow your provider's domain authentication setup (SendGrid: Settings > Sender Authentication; Postmark: Sender Signatures; AWS SES: Verified Identities).
# DNS records for example.com:
# SPF — authorize your sending provider
example.com. TXT "v=spf1 include:sendgrid.net ~all"
# DKIM — your provider generates the key pair
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=<public-key-from-provider>"
# DMARC — start with p=none to collect reports, then escalate
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
# Escalate to p=quarantine, then p=reject once reports confirm alignment
Verify configuration with MXToolbox (mxtoolbox.com/SuperTool.aspx) after adding DNS records. Enroll in Gmail Postmaster Tools for ongoing DMARC and deliverability monitoring.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Email & SMS Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-290 — Authentication Bypass by Spoofing (domain authentication prevents spoofing)
- external · CAN-SPAM-§5(a)(1) — CAN-SPAM Act §5(a)(1) — Accurate routing/sender information; DMARC enforces sender domain authenticity
- nist:rev5 · SC-8 — NIST 800-53 SC-8 — Transmission Confidentiality and Integrity (email auth as integrity control)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from email-sms-compliance·automated