SPF, DKIM i DMARC: Kompletan vodič za email autentifikaciju

← Blog

Zašto je email autentifikacija važna?

Bez email autentifikacije, napadač može poslati email sa adresom [email protected] koji prolazi kroz inbox zaposlenih, kupaca i partnera. Ovo se zove email spoofing i osnova je phishing napada. Procena je da se 3 milijarde lažnih emailova šalje dnevno koristeći legitimne domene.

Google i Yahoo su od februara 2024. uveli obavezne zahteve za SPF i DKIM za sve pošiljaoce bulk emailova, a DMARC politiku preporučuju kao standard. Bez ove konfiguracije, vaši emailovi završavaju u spamu — ili se nikada ne dostavljaju.

SPF (Sender Policy Framework)

SPF je TXT DNS zapis koji definiše koje IP adrese i mailserveri smeju slati emailove u ime vašeg domena. Kada primajući server dobije email sa vašim domenom, proverava SPF zapis da potvrdi da li je pošiljalac ovlašćen.

Primer SPF zapisa

v=spf1 include:_spf.google.com include:sendgrid.net ip4:185.220.101.0/24 ~all

Tumačenje: dozvolite servere Google-a, Sendgrid-a i IP adrese iz navedenog ranga. ~all znači "softfail" — emailovi koji ne prolaze dobijaju oznaku sumnjivog, ali se ne odbijaju odmah (za strože odbijanje koristite -all).

Greške koje treba izbeći

• Više SPF zapisa za isti domen (samo jedan sme postojati — kombinirajte sve u jedan)
• Previše DNS lookup-a (limit je 10 — koristite SPF Flattening alate)
• +all koji dozvoljava bilo koga (nikada ne koristiti)

DKIM (DomainKeys Identified Mail)

DKIM dodaje digitalni potpis emailu koji primalac može verificirati koristeći javni ključ objavljen u DNS-u. Za razliku od SPF-a koji proverava IP adresu, DKIM proverava da email nije izmenjen tokom transporta.

Kako funkcioniše

1. Vaš mail server potpisuje email privatnim ključem
2. Potpis se dodaje u DKIM-Signature header
3. Primajući server preuzima javni ključ iz vašeg DNS-a
4. Ako se potpis poklapa, email je autentičan i nije izmenjen

DNS zapis za DKIM

mail._domainkey.vasafirma.rs  IN  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

Prefix mail je selektor — možete imati više selektora za različite servise.

DMARC (Domain-based Message Authentication)

DMARC je politika koja govori primajućim serverima šta da rade sa emailovima koji ne prođu SPF ili DKIM provjeru. Daje vam vidljivost u ko šalje emailove u vaše ime, i kontrolu nad time šta se dešava sa lažnim porukama.

Primer DMARC zapisa

_dmarc.vasafirma.rs  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

Politike

• p=none — samo prati, ne preduzima akciju (idealno za početak)
• p=quarantine — emailovi koji ne prođu idu u spam
• p=reject — emailovi koji ne prođu se odbijaju (maksimalna zaštita)

Implementacija korak po korak

1. Identifikujte sve servise koji šalju email sa vašeg domena (CRM, newsletter, transakcioni emailovi)
2. Dodajte SPF TXT zapis sa svim ovlašćenim serverima
3. Generiujte DKIM ključeve u vašem email provajderu i dodajte javni ključ u DNS
4. Dodajte DMARC zapis sa p=none i rua adresom za izveštaje
5. Pratite izveštaje i postepeno pooštrujte politiku

Provera konfiguracije

Shieldome Scout automatski proverava SPF, DKIM i DMARC konfiguraciju vašeg domena kao deo standardne procene: otkriva nedostajuće zapise, prestroge ili preslabe politike, i konflikte koji mogu uzrokovati da legitimni emailovi završe u spamu.

← Blog

Why Email Authentication Matters

Without email authentication, an attacker can send an email from [email protected] that passes through the inboxes of employees, customers, and partners. This is called email spoofing and is the foundation of phishing attacks. An estimated 3 billion fake emails are sent daily using legitimate domains.

Google and Yahoo introduced mandatory requirements for SPF and DKIM for all bulk email senders in February 2024, and recommend DMARC policy as a standard. Without this configuration, your emails end up in spam — or are never delivered.

SPF (Sender Policy Framework)

SPF is a TXT DNS record that defines which IP addresses and mail servers are authorized to send emails on behalf of your domain. When a receiving server gets an email with your domain, it checks the SPF record to verify that the sender is authorized.

Example SPF Record

v=spf1 include:_spf.google.com include:sendgrid.net ip4:185.220.101.0/24 ~all

Interpretation: allow Google's servers, Sendgrid servers, and IP addresses in the specified range. ~all means "softfail" — emails that don't pass get marked as suspicious but aren't immediately rejected (use -all for stricter rejection).

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to an email that the recipient can verify using a public key published in DNS. Unlike SPF which checks IP addresses, DKIM verifies that the email was not altered during transit.

How It Works

1. Your mail server signs the email with a private key
2. The signature is added to the DKIM-Signature header
3. The receiving server retrieves the public key from your DNS
4. If the signature matches, the email is authentic and unaltered

DMARC (Domain-based Message Authentication)

DMARC is a policy that tells receiving servers what to do with emails that fail SPF or DKIM verification. It gives you visibility into who is sending emails on your behalf, and control over what happens to fake messages.

Example DMARC Record

_dmarc.yourcompany.com  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

Policies

• p=none — monitor only, take no action (ideal for starting out)
• p=quarantine — emails that don't pass go to spam
• p=reject — emails that don't pass are rejected (maximum protection)

Step-by-Step Implementation

1. Identify all services that send email from your domain (CRM, newsletter, transactional emails)
2. Add an SPF TXT record with all authorized servers
3. Generate DKIM keys in your email provider and add the public key to DNS
4. Add a DMARC record with p=none and a rua address for reports
5. Monitor reports and gradually tighten the policy

Configuration Verification

Shieldome Scout automatically checks SPF, DKIM, and DMARC configuration for your domain as part of a standard assessment: it detects missing records, overly strict or weak policies, and conflicts that may cause legitimate emails to end up in spam.