How SPF and DMARC records work within ESS Anti-Spam Spoofed Sender Detection services

Products

• Email Security.cloud

Issue/Introduction

This article outlines different scenarios involving SPF and DMARC records, along with the corresponding actions taken by the Spoofed Sender Detection services.

Environment

Symantec Email Security.Cloud

Resolution

Here are 29 different scenarios based on the SPF and DMARC DNS records, along with the configured actions in the SPF and DMARC sections on the Anti-Spam page.

 

#	Sender SPF(-all)	Sender DMARC	CNet Action SPF/DMARC	SPF/DMARC AuthResult	Expected Email Verdict	Comment/ Action taken
1	True	True	Block / Quarantine	Fail / Fail	Clientnet DMARC Action	Quarantine
2	True	False (p=None)	Block / Quarantine	Fail / Fail	Clientnet SPF Action	Blocked
3	True	True	Redirect / Off	Fail / Fail	Clientnet SPF Action	Redirected
4	True	False (p=None)	Quarantine / Off	Fail / Fail	Clientnet SPF Action	Quarantine
5	True	True	Off / Block	Fail / Fail	Clientnet DMARC Action	Blocked
6	True	False (p=None)	Off / Tag subject	Fail / Fail	Sender DMARC Policy	SPF Logged
7	False	True	Redirect / Append	Fail (Softfail) / Fail	Clientnet DMARC Action	Append
8	False	False (p=None)	Quarantine / Block	Fail (Softfail) / Fail	Sender DMARC Policy	Pass Thru - SPF Result Softfail
9	False	True	Off / Sender's policy	Fail (Softfail) / Fail	Clientnet DMARC Action	Quarantine as Set In DNS
10	False	False (p=None)	Off / Sender's policy	Fail (Softfail) / Fail	Sender DMARC Policy	Pass Thru - SPF Result Softfail
11	False	True	Append / Off	Fail (Softfail) / Fail	Sender DMARC Policy	DMARC Logged
12	False	False (p=None)	Append / Off	Fail (Softfail) / Fail	Email Pass Thru	Pass Thru - SPF Result Softfail
13	True	True	Block / Append	Fail / Fail	Clientnet DMARC Action	Append
14	True	False (p=None)	Off / Off	Fail / Fail	Sender DMARC Policy	SPF Logged
15	True	True	Off / Off	Fail / Fail	Sender DMARC Policy	DMARC Logged
16	True	True	Block / Append	Pass / Fail	Email Pass Thru	DMARC, SPF, DKIM - Pass
17	True	True	Append / Off	Pass / Fail	Email Pass Thru	SPF, DMARC - Pass, DKIM - Fail
18	True	True	Block / Sender's policy	Pass / Fail	Email Pass Thru	DKIM, DMARC - Pass, SPF - Fail
19	True	False (p=None)	Off / Off	Pass / Fail	Email Pass Thru	Pass Thru
20	True	True	Off / Off	Pass / Fail	Sender DMARC Policy	DMARC Logged
21	True	True	Block / Append	Pass / Fail	Clientnet DMARC Action	Append
22	True	True	Append / Off	Pass / Fail	Sender DMARC Policy	DMARC Logged
23	True	True	Block / Sender's policy	Pass / Fail	Sender DMARC Policy	DMARC Blocked
24	True	False (p=None)	Off / Off	Fail / Pass	Email Pass Thru	Pass Thru - DMARC Check Pass, P=None Check Not Performed.
25	True	True	Off / Off	Fail / Pass	Email Pass Thru	Pass Thru
26	True	True	Block / Append	Fail / Pass	Email Pass Thru	Pass Thru
27	True	True	Append / Off	Fail / Pass	Clientnet SPF Action	Append
28	True	True	Block / Sender's policy	Fail / Pass	Email Pass Thru	Pass Thru
29	True	True	Off / Sender's policy (p=quarantine)	Fail (Softfail) / Fail	Clientnet DMARC Action	If account lacks Quarantine, email gets its subject tagged instead. Pass Thru