Publish and verify domain authentication records

short · 45 min · Objective 3.4

Task

Configure the three domain authentication mechanisms for a domain you control, verify each independently, and stage the policy rather than jumping to reject.

Steps

  1. Publish an SPF record listing only authorised senders, and verify it resolves and parses, capturing the result in lab/spf.txt.
  2. Configure DKIM signing and verify a signed message validates against the published key, capturing it in lab/dkim.txt.
  3. Publish DMARC in MONITOR mode with reporting, and record in lab/dmarc-stage.md why starting at reject reliably blocks a genuine service nobody remembered.
  4. From the reports or from your own sending inventory, list every legitimate sender in lab/senders.csv as sender,authorised,aligned.
  5. Write lab/email-limits.md naming three attacks that pass all three mechanisms perfectly -- display-name spoofing, lookalike domains, a compromised legitimate account.

Verify

grep -Eci 'v=spf1' lab/spf.txt
grep -Eci 'dkim=pass|signature ok|verified' lab/dkim.txt
grep -Eci 'monitor|p=none|stage' lab/dmarc-stage.md
awk -F, 'NR>1 {n++} END {print n" sender(s)"}' lab/senders.csv
grep -Ec . lab/email-limits.md

All three mechanisms verified, DMARC staged rather than enforced, senders enumerated, and three bypasses named. The limits file is what stops this being read as an answer to phishing.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.