Observed standard
Begin here when you need to understand SPF, DKIM, DMARC and transport policies. Stay with the domain, relationship or service state named on the page; the task does not widen silently into a different security or product claim.
Resource library
Email authentication guide
This page helps you understand SPF, DKIM, DMARC and transport policies. Practical guidance should make external evidence easier to interpret without removing the need to validate it.
Bounded collection. Explicit permission. No exploitation or authentication attempts.
What this guidance covers
Understand SPF, DKIM, DMARC and transport policies
Practical guidance should make external evidence easier to interpret without removing the need to validate it. This page helps you understand SPF, DKIM, DMARC and transport policies. The relevant evidence, owner and limit remain available from the same route.
Useful for: Microsoft 365 administrator · DNS owner.
In practice
How to use this guidance
Common interpretation error
The first-party Signals Exposure Index records DNS, certificate, TLS, HTTP, email, service, attribution and evidence-quality observations when applicable. Open the relevant report evidence when you need to verify the source, observation time, attribution or qualification behind it.
Safe implementation sequence
Complete the step shown on the page, then check the resulting state before moving on. Unknown, unavailable and not-applicable outcomes remain distinct, so absence is never presented as a successful or reassuring result.
Verification and rollback
Repeat the assessment only when the resulting evidence will be comparable. Record the resulting owner, evidence or recovery state where the product provides it, so another person can verify what happened without repeating the task.
What you can rely on
What to carry into practice
Use the guidance with the evidence state and its limits.
Clear scope
The assessment uses direct protocol observations and passive intelligence but stops before exploitation, authentication attempts, brute force and fuzzing.
Traceable evidence
The first-party Signals Exposure Index records DNS, certificate, TLS, HTTP, email, service, attribution and evidence-quality observations when applicable.
Honest limits
The Overall Signals Grade covers external evidence included in the assessment, not the organisation's complete security or breach likelihood.
Important boundary
What this does not mean
Email authentication guide supports one defined outcome: understand SPF, DKIM, DMARC and transport policies. Domain Signals is not a penetration test, certification, data-residency assessment or prediction of breach likelihood. Missing evidence is not evidence of safety.
Questions answered
Read the conclusion and its limits together
What does Email authentication guide help me decide?
This page helps you understand SPF, DKIM, DMARC and transport policies.
What evidence sits behind the answer?
Domain Signals keeps the source, observation time and evidence state alongside each conclusion. The relevant report view provides the technical detail when you need to inspect it.
What should I not conclude?
Email authentication guide supports one defined outcome: understand SPF, DKIM, DMARC and transport policies. Domain Signals is not a penetration test, certification, data-residency assessment or prediction of breach likelihood. Missing evidence is not evidence of safety.
Keep exploring