Sequence of Message Authentication

Find out how the different message authentications are processed in Sophos Email Security.

Message authentication comprises three checks: DMARC, SPF, and DKIM, which are performed in the order that they're listed. The DMARC check depends on the SPF and DKIM checks. DMARC can only be evaluated if the sender has a valid DMARC record in DNS and supports SPF or DKIM checking. To perform the DMARC check, the SPF and the DKIM check are performed, regardless of the failure options configured in the policy. If neither the SPF check nor the DKIM check passes, the DMARC check fails.

If your Email Security policy applies Quarantine or Reject actions to DMARC, SPF, and DKIM checks, and the email passes all of these checks, the header anomaly checks won't be processed and the email will be delivered.

If DMARC, SPF, or DKIM fails, the Quarantine or Reject action will apply and not continue to process.

For more information on these checks, see the following:

• DMARC
• SPF
• DKIM
• How Message Authentication works

Message Authentication flow chart

The following flow chart shows the order in which these message authentications are carried out in different scenarios, and what happens when each message authentication passes or fails.

Message Authentication decision table

The following decision table shows you the actions taken for every combination of policy setting and check result.