MESSAGING DEEP CORE
SPF, DKIM, DMARC and Defender for Office 365 Deep Core
Modern mail security goes far beyond anti-virus on the Exchange server.
Chapter purpose
Combine sender authentication, content filtering and investigation into one modern mail-security model.
Learning objectives
- Explain SPF, DKIM and DMARC together.
- Understand why TLS is different from sender authentication.
- Explain cloud filtering layers.
- Build a phishing investigation workflow.
Why this matters in a real company
Email is a major path for business email compromise and phishing. Authentication and cloud security controls reduce risk without relying only on user judgement.
7.1 SPF authorizes sending infrastructure
SPF publishes which infrastructure is authorized to send using a domain in the SMTP envelope. SPF alone does not prove the visible From address.
Maintain one valid SPF record and inventory every legitimate sender.
7.2 DKIM signs and DMARC aligns
DKIM adds a verifiable signature associated with a domain. DMARC evaluates alignment between the visible From domain and authenticated SPF or DKIM identities, then publishes policy and reporting.
Roll out DMARC using reports and evidence so legitimate SaaS senders are aligned before stronger policy.
7.3 Cloud filtering adds behavioral and content controls
Exchange Online Protection and Defender for Office 365 can add anti-spam, anti-malware, anti-phishing, URL and attachment protections depending on licensing and configuration.
Email authentication and content/security analysis solve different problems and should work together.
7.4 Investigate suspicious mail systematically
- Preserve message/header.
- Identify recipients.
- Check SPF/DKIM/DMARC results.
- Review URL/attachment verdicts.
- Search for related messages.
- Remediate mail and identity risk.
- Document incident.
# Illustrative DNS only. Do not copy without validating your senders.
example.com. TXT "v=spf1 include:spf.protection.outlook.com -all"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Alignment is the key DMARC concept
SPF validates the envelope-sender domain against authorized infrastructure. DKIM validates a cryptographic signature for a signing domain. DMARC asks whether one of those authenticated domains aligns with the domain visible to the user in the From address.
This is why a message can pass SPF but still fail DMARC. The sender may be authorized for one domain while impersonating another visible domain.
Security operations after delivery
Modern mail defense includes investigation after a message is delivered. Security teams may need to search for similar messages, identify who clicked a link, remove malicious mail and inspect related sign-in activity. Email security is therefore connected to identity and endpoint response.
Exceptions should be rare and temporary. A permanent safe-sender rule for an improperly configured external system can bypass protections that would otherwise detect impersonation.
Finance receives fake supplier bank-change mail
The message uses a lookalike domain and convincing branding but no malware attachment.
Decision: Treat it as phishing/business email compromise, not simply an anti-virus issue. Investigate sender identity, related messages and user interaction.
Evidence: Document campaign scope, affected users and any identity/financial follow-up.
Hands-on lab
Map Microsoft 365, ERP, CRM, website and marketing senders. Record From domain, envelope domain, SPF source and DKIM capability.
Troubleshooting exercise
- SPF passes but DMARC fails: check alignment.
- Multiple SPF records: consolidate correctly.
- Legitimate SaaS mail fails after DMARC tightening: fix sender alignment rather than weakening everything.
Field checklist
- All senders inventoried.
- One SPF record.
- DKIM enabled where supported.
- DMARC reports monitored.
- Defender/EOP baseline configured.
- Exceptions owned and reviewed.
Current technical references
The supplied PDF books are used as a historical curriculum map. Current implementation guidance is checked against current Microsoft documentation.