{"id":4524,"date":"2026-10-12T12:58:37","date_gmt":"2026-10-12T10:58:37","guid":{"rendered":"https:\/\/www.klytic.com\/spf-dkim-dmarc\/"},"modified":"2026-10-12T13:31:51","modified_gmt":"2026-10-12T11:31:51","slug":"spf-dkim-dmarc-en","status":"publish","type":"page","link":"https:\/\/www.klytic.com\/en\/spf-dkim-dmarc-en\/","title":{"rendered":"SPF, DKIM and DMARC: what they protect, and what they do not"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"4524\" class=\"elementor elementor-4524 elementor-4319\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-49f3b97 e-con-full kly-g e-flex e-con e-parent\" data-id=\"49f3b97\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-68ebbdd e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"68ebbdd\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-f144629 e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"f144629\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0f7dac1 elementor-widget elementor-widget-text-editor\" data-id=\"0f7dac1\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/email-security\/\">Email security<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#f87171\">Email security \u00b7 Understand<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d803fe3 elementor-widget elementor-widget-heading\" data-id=\"d803fe3\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">SPF, DKIM and DMARC: what they protect, and what they do not<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fac821b elementor-widget elementor-widget-text-editor\" data-id=\"fac821b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">SPF states which servers may send for a domain, DKIM signs the message, and DMARC checks that one of the two matches the domain shown in \u201cFrom\u201d and says what to do if the check fails. Together, they prevent a stranger from using your exact domain. They do not read the text: a cousin domain, a misleading display name or a compromised account all get through.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1427747 elementor-widget elementor-widget-text-editor\" data-id=\"1427747\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>6 min<\/b><\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5156486 e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"5156486\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-ab1088e e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"ab1088e\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-04376aa elementor-widget elementor-widget-text-editor\" data-id=\"04376aa\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>SPF: who is allowed to send<\/h2>\n<p>RFC 7208 starts from an observation: nothing in the email protocol prevents a server from claiming any sender address. SPF lets a domain owner publish in DNS the list of servers authorized to send on its behalf, and lets the receiving server check that authorization.<\/p>\n<p>Two details change everything:<\/p>\n<ul>\n<li>SPF checks the envelope address (the one used in the dialogue between servers, known as \u201cMAIL FROM\u201d) and the name announced by the server, not the address the recipient reads in \u201cFrom.\u201d<\/li>\n<li>SPF judges the last server that handed over the message. When a message is forwarded by another server, it is no longer a server authorized by the original domain that delivers it: the check can fail even though the message is legitimate.<\/li>\n<\/ul>\n<p>A domain publishes only one SPF record. Every sending source must be listed in it: email service, invoicing software, newsletter tool, CRM, copier that scans to email.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d789e98 elementor-widget elementor-widget-text-editor\" data-id=\"d789e98\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>DKIM: the message is signed<\/h2>\n<p>According to RFC 6376, DKIM allows the owner of a signing domain to claim some responsibility for a message, by means of a cryptographic signature. The public key is in DNS. Verifying the signature establishes that the signed parts have not changed since signing.<\/p>\n<p>The signature travels with the message. It therefore survives a relay or forwarding better than SPF does, as long as that relay does not modify the subject or the body. A mailing list that adds a footer to the message breaks it.<\/p>\n<p>What DKIM does not do, according to the same RFC: it does not encrypt the message, a failure does not require rejection, and the signing domain does not have to be the one shown in \u201cFrom.\u201d That is precisely the gap DMARC fills.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1fcae7e elementor-widget elementor-widget-text-editor\" data-id=\"1fcae7e\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>DMARC: alignment and policy<\/h2>\n<p>RFC 7489 defines DMARC as a way for a domain owner to express a domain-level policy. The mechanism relies on alignment: the domain of the address shown in \u201cFrom\u201d must match the domain validated by SPF or by DKIM. If neither is aligned, DMARC fails.<\/p>\n<p>The domain then publishes what it wants:<\/p>\n<ul>\n<li><strong>none<\/strong>: no action requested, monitoring only;<\/li>\n<li><strong>quarantine<\/strong>: treat the message as suspicious;<\/li>\n<li><strong>reject<\/strong>: reject the message.<\/li>\n<\/ul>\n<p>DMARC also provides for reports: aggregate reports, which summarize which servers sent on behalf of the domain and with what result, and failure reports, message by message. These are what let you discover a forgotten tool sending on your behalf, or someone spoofing your domain.<\/p>\n<div class=\"kly-table\"><table><thead><tr><th>Mechanism<\/th><th>What it checks<\/th><th>What it does not look at<\/th><\/tr><\/thead><tbody>\n<tr><td>SPF<\/td><td>The server delivering the message is authorized for the envelope domain<\/td><td>The displayed address, the content<\/td><\/tr>\n<tr><td>DKIM<\/td><td>The signed message has not been altered; a domain takes responsibility for it<\/td><td>The displayed address, the honesty of the content<\/td><\/tr>\n<tr><td>DMARC<\/td><td>The displayed domain is aligned with SPF or DKIM; policy in case of failure<\/td><td>Lookalike domains, the display name, the text<\/td><\/tr>\n<\/tbody><\/table><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-632832c elementor-widget elementor-widget-text-editor\" data-id=\"632832c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Does DMARC block phishing?<\/h2>\n<p>It blocks part of domain spoofing, not phishing in general. RFC 7489 says so explicitly: DMARC does not address visually similar domain names or display-name abuse, and content analysis is outside its scope. It does not attempt to solve every problem of fraudulent email.<\/p>\n<p>In practice, DMARC does not see:<\/p>\n<ul>\n<li><strong>a cousin domain<\/strong>: the fraudster perfectly authenticates their own domain, which looks like yours;<\/li>\n<li><strong>a spoofed display name<\/strong>: \u201cAccounting Department\u201d writing from an unrelated address;<\/li>\n<li><strong>a compromised account<\/strong> that signs correctly, since it is the real server that sends;<\/li>\n<li><strong>a message unrelated to your domain<\/strong>: a fake carrier alert arrives from a domain that has nothing to do with yours;<\/li>\n<li><strong>a domain without a policy<\/strong>: if the imitated domain publishes \u201cnone,\u201d the recipient has no instruction to reject.<\/li>\n<\/ul>\n<p>These cases call for other analyses: domain similarity, reputation, content, behavior. See <a href='\/en\/spam-phishing-malware-compromised-account\/'>spam, phishing, malware and compromised accounts<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0edc27a elementor-widget elementor-widget-text-editor\" data-id=\"0edc27a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Forwarding and mailing lists: ARC<\/h2>\n<p>Forwarding often breaks SPF, a list that modifies the message breaks DKIM, and DMARC then fails on a legitimate message. ARC, described in RFC 8617 (experimental status), lets each intermediary attest to the authentication result it observed. The final server may choose to take it into account.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-af80e3a elementor-widget elementor-widget-text-editor\" data-id=\"af80e3a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Protecting your domain vs. filtering what comes in<\/h2>\n<p>These are two topics that are often confused.<\/p>\n<ul>\n<li><strong>Protecting the sending domain<\/strong>: publishing SPF, DKIM and DMARC for your domain, so that others can refuse messages that spoof it. You publish; recipients enforce.<\/li>\n<li><strong>Filtering what comes in<\/strong>: checking other domains\u2019 records on the mail you receive, then applying all the other analyses.<\/li>\n<\/ul>\n<h3>Phased deployment<\/h3>\n<ol>\n<li>Inventory everything that sends on behalf of the domain.<\/li>\n<li>A single SPF record that authorizes them; a DKIM signature for each service capable of signing.<\/li>\n<li>DMARC set to \u201cnone,\u201d with an address to receive reports.<\/li>\n<li>Review the reports for several weeks; fix forgotten sources.<\/li>\n<li>Move to \u201cquarantine,\u201d then to \u201creject\u201d once all legitimate sending is aligned.<\/li>\n<\/ol>\n<p>An example, for illustration. A firm publishes DMARC at \u201cnone\u201d and reads its first reports. It discovers three sources: its email service, properly aligned; its invoicing software, which sends invoices with the firm\u2019s domain without a DKIM signature; and an unknown server abroad sending hundreds of messages in its name. It fixes the invoicing software, waits for a clean report cycle, then moves to \u201cquarantine\u201d: recipients that enforce DMARC now treat messages from the unknown server as suspicious.<\/p>\n<p>When you change email services, these records are prepared before the MX change. The guide <a href='\/en\/migrate-email-without-downtime\/'>migrating email without interruption<\/a> describes that moment; it is not repeated here.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c604127 elementor-widget elementor-widget-text-editor\" data-id=\"c604127\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2>\n<h3>Does a DMARC \u201cnone\u201d policy protect?<\/h3>\n<p>No. It allows monitoring through reports. Protection starts with \u201cquarantine\u201d or \u201creject.\u201d<\/p>\n<h3>Why does a legitimate message fail DMARC?<\/h3>\n<p>Most often: forwarding, a mailing list, or a service sending on your behalf without being declared in SPF or signing with DKIM.<\/p>\n<h3>Our email service does not DKIM-sign: what should we do?<\/h3>\n<p>A gateway placed on the outbound path can sign in its place. See <a href='\/en\/protect-existing-email\/'>Protecting the email system you already have<\/a>.<\/p>\n<h3>Where can I read the result of these checks on a received message?<\/h3>\n<p>In the message headers. For Klytic MTA, see <a href='\/en\/audit-filter-decisions\/'>Reading and exporting a filter decision<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c8c0295 kly-g-klytic elementor-widget elementor-widget-text-editor\" data-id=\"c8c0295\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Where Klytic stands<\/h2>\n<p><a href='\/en\/klytic-mta\/'>Klytic MTA<\/a> handles both topics, in front of any email service:<\/p>\n<ul>\n<li><strong>Essential and Advanced<\/strong>: SPF, DKIM and MX checks; DMARC verification, including for forwarded messages thanks to ARC; DKIM signing of outgoing mail, even if your email service does not do it.<\/li>\n<li><strong>Advanced<\/strong>: DMARC console, with your domains\u2019 reports, alerts and suggested fixes, to manage the gradual move to \u201creject.\u201d<\/li>\n<\/ul>\n<p>DMARC is only one layer: Klytic MTA adds detection of lookalike domains, display names and fraud scenarios, described in <a href='\/en\/ceo-fraud-impersonation\/'>impersonation and CEO fraud<\/a>.<\/p>\n<p>If you use <a href='\/en\/klytic-mail\/'>Klytic Mail<\/a>, SPF, DKIM and DMARC are configured for your domain: that is protection of the sending domain. Klytic MTA can be subscribed to with or without Klytic Mail.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-98f07c7 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"98f07c7\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Consulted in October 2026.<\/p><ul><li>RFC 7208, SPF: the domain owner publishes the hosts authorized to use its domain in the \u201cMAIL FROM\u201d or \u201cHELO\u201d identity, and the receiver checks that authorization. <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc7208' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>RFC 6376, DKIM: a domain claims responsibility for a message through a cryptographic signature; no encryption, no mandatory rejection, the signing domain may differ from the displayed author. <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc6376' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>RFC 7489, DMARC: alignment of the \u201cFrom\u201d domain with SPF or DKIM, none, quarantine and reject policies, aggregate and failure reports; visually similar domains, display name and content analysis out of scope. <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc7489' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>RFC 9989 (May 2026), which obsoletes RFC 7489: same policy values and same exclusions (lookalike domains, display name). <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc9989' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>RFC 8617, ARC (experimental): authenticated received chain; a DMARC receiver may accept the evaluations carried by a valid ARC chain. <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc8617' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>Klytic, Klytic MTA page: authentication checks, outbound DKIM signing and DMARC console in the Essential and Advanced plans, options, deployment modes, activation via the MX record. <a href='https:\/\/www.klytic.com\/klytic-mta\/' rel='noopener' target='_blank'>klytic.com<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-27b9c0c e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"27b9c0c\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c1a48a5 elementor-widget elementor-widget-html\" data-id=\"c1a48a5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"On this page\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a3a5fd6 elementor-widget elementor-widget-text-editor\" data-id=\"a3a5fd6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>Verify and sign, in front of your email service<\/h3><p>Klytic MTA checks SPF, DKIM and DMARC on arrival and signs your outgoing mail.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/klytic-mta\/\">Discover Klytic MTA<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-62dc2ec e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"62dc2ec\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-41903a0 elementor-widget elementor-widget-text-editor\" data-id=\"41903a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/migrate-email-without-downtime\/\" style=\"--cat:#0077cc\"><span class=\"c\">Guides<\/span><span class=\"t\">How do you migrate a business email service without downtime?<\/span><span class=\"q\">Coexistence, second pass, MX TTL, SPF, DKIM, DMARC and test sends: switching email services without losing mail, and what remains visible.<\/span><span class=\"m\"><span>Guides<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/spam-phishing-malware-compromised-account\/\" style=\"--cat:#dc2626\"><span class=\"c\">Understand \u00b7 Email security<\/span><span class=\"t\">Spam, phishing, malware and compromised accounts<\/span><span class=\"q\">Four threats come through the same door and are not handled the same way. What gives each one away, what stops it, and why anti-spam alone is no longer enough.<\/span><span class=\"m\"><span>6 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/protect-existing-email\/\" style=\"--cat:#dc2626\"><span class=\"c\">Understand \u00b7 Email security<\/span><span class=\"t\">Protecting the email system you already have<\/span><span class=\"q\">Microsoft 365, Google Workspace, Exchange: you can add a security gateway without changing email services. What changes, who sets it up, the limits.<\/span><span class=\"m\"><span>7 min read<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47ba7642 e-con e-atomic-element e-div-block-base e-default-div e-47ba7642-0a8d8cb \" data-id=\"47ba7642\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"47ba7642\" data-e-type=\"e-div-block\" data-id=\"47ba7642\">\n    <div class=\"elementor-element elementor-element-1957dcf0 e-con e-atomic-element e-div-block-base e-default-div e-1957dcf0-65bb45b \" data-id=\"1957dcf0\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"1957dcf0\" data-e-type=\"e-div-block\" data-id=\"1957dcf0\">\n    \t\t\t<p class=\"e-34902a51-b78d132 e-paragraph-base e-default-p\" data-interaction-id=\"34902a51\" data-e-type=\"widget\" data-id=\"34902a51\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"54c96233\" class=\"e-54c96233-632171d e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"54c96233\">30 days free trial, migration support included<\/h2>\n\t\t\t\t\t<p class=\"e-6661c7ce-fdde46c e-paragraph-base e-default-p\" data-interaction-id=\"6661c7ce\" data-e-type=\"widget\" data-id=\"6661c7ce\">No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.<\/p>\n\t\t<div class=\"elementor-element elementor-element-761c01f e-con e-atomic-element e-div-block-base e-default-div e-761c01f-cf11a99 \" data-id=\"761c01f\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"761c01f\" data-e-type=\"e-div-block\" data-id=\"761c01f\">\n    \t\t\t<a href=\"https:\/\/www.klytic.com\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-2f43419f-52885cf e-button-base e-default-a\" data-interaction-id=\"2f43419f\" data-e-type=\"widget\" data-id=\"2f43419f\">\n\t\ud83d\ude80 Start the free trial\n<\/a>\n\t\t\t\t\t<a href=\"https:\/\/www.klytic.com\/en\/pricing\/\" target=\"_self\" class=\"e-31327e4d-45bbc1a e-button-base e-default-a\" data-interaction-id=\"31327e4d\" data-e-type=\"widget\" data-id=\"31327e4d\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"SPF, DKIM and DMARC: what they protect and don\u2019t | Klytic","_seopress_titles_desc":"SPF, DKIM and DMARC explained: what each one checks, why DMARC does not block phishing in general, forwarding and ARC, phased deployment.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"SPF, DKIM and DMARC: what they protect and don\u2019t | Klytic","_seopress_social_fb_desc":"SPF, DKIM and DMARC explained: what each one checks, why DMARC does not block phishing in general, forwarding and ARC, phased deployment.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"SPF, DKIM and DMARC: what they protect and don\u2019t | Klytic","_seopress_social_twitter_desc":"SPF, DKIM and DMARC explained: what each one checks, why DMARC does not block phishing in general, forwarding and ARC, phased deployment.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-4524","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/4524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=4524"}],"version-history":[{"count":0,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/4524\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=4524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}