SPF, DKIM and DMARC
SPF · DKIM · DMARCThe three mechanisms that establish whether a message really came from the domain it claims: SPF authorises sending servers, DKIM signs the message cryptographically, and DMARC ties the two to a published policy.
SPF (Sender Policy Framework) is a DNS record listing which servers may send mail for a domain; the receiving server checks the connecting address against that list. DKIM (DomainKeys Identified Mail) goes further: the sending domain signs the body and a chosen set of headers with a private key and adds a DKIM-Signature header, which anyone can verify against the public key published in DNS. DMARC sits on top, telling receivers what to do when those checks fail and requiring the authenticated domain to match the visible From: address.
In an archived mailbox the practical trace of all this is the Authentication-Results header, written by the receiving server at the moment of delivery. It records the verdict that was reached then — pass, fail or none — which is precisely the point: it captures what was known when the message arrived.
A DKIM signature can in principle be re-verified years later, but only while the domain still publishes the matching public key, and operators rotate those keys routinely. So a signature that no longer verifies is not evidence of tampering: it is often just an expired key. That nuance matters whenever archived mail is offered as proof of anything.
Related terms
The structured metadata block at the beginning of an email message, containing fields like From, To, Subject, Date, and numerous technical fields that describe how the message was composed, routed, and encoded.
The header each mail server adds as a message passes through it. Read from the bottom up, the Received lines reconstruct the route a message actually travelled.
The legal process of identifying, preserving, reviewing and handing over electronic records — email above all. It is the reason most people ever need to cut a mailbox down to a specific set of messages.