Question

MTAs are unauthenticated. What effect would requiring user authentication to send email have on the email system?

Answer 1

Email authentication a set of methods that receiving email servers use to ensure that emails are not forged. Authenticating an email verifies that the email message actually came from the sender listed in the “from” field in the email header, and that the email wasn’t changed by someone while it was in transit.

Email providers use email authentication to protect users from spam, phishing scams, and other malicious emails.

Most authentication information is transmitted in the email message header. The person reading the email usually doesn’t see the authentication information. So, authenticating your emails has no impact on the quality of your email content.

Simple Mail Transfer Protocol (SMTP), the basic email sending protocol, doesn’t include any authentication mechanisms.

So, SPF, DKIM, and DMARC standards were developed to enhance the security of SMTP. We’ll cover these standards in detail a little further on. For now, just know that you need to use all three of them to get a fully functioning email authentication system.

How email authentication works?

1. An organization or domain owner establishes rules for authenticating emails sent from all of its sending domains.
2. The organization configures its sending email servers and email infrastructure to implement these rules.
3. The email authentication rules are published in the DNS records (Domain Name System records) for each sending domain.
4. Receiving mail servers authenticate emails from an email sender according to the authentication rules the sending domain has published.
5. Receiving email servers handle emails according to the authentication results to correctly deliver, quarantine, or reject emails.