## Authentication: SPF, DKIM, DMARC

The Trinity of Email Security.

### 1. SPF (Sender Policy Framework)
*   **Identity Card**.
*   DNS TXT Record: `v=spf1 include:_spf.google.com -all`
*   **Meaning**: "Only Google's servers are allowed to send email for my domain. Reject everyone else."
*   **Check**: Look for `Authentication-Results: spf=pass` in the header.

### 2. DKIM (DomainKeys Identified Mail)
*   **Wax Seal**.
*   Cryptographic signature attached to the email.
*   **Meaning**: "This email has not been modified in transit."
*   **Check**: Look for `dkim=pass`.

### 3. DMARC (Domain-based Message Authentication)
*   **The Policy**.
*   "If SPF fails OR DKIM fails, what should I do?"
    *   `p=none`: Do nothing (Analysis mode).
    *   `p=quarantine`: Send to Spam folder.
    *   `p=reject`: Bounce the email (Delete it).
*   **Goal**: Every company wants to be at `p=reject`.