Five protocols, one job: prove an email is what it claims to be. Most guides cover them one at a time, as if they’re separate tools you pick between. Chapter 6 treats them as what they actually are — a single layered system where each protocol exists specifically because the one before it wasn’t enough.
SPF answers “did this come from a server allowed to send for this domain?” by checking the sending IP against a DNS record. DKIM answers a different question — “was this message altered in transit?” — with a cryptographic signature verified against a public key in DNS. Neither one, alone, stops someone from spoofing your visible From address while passing their own SPF and DKIM checks on a different domain.
That’s the gap DMARC closes. It ties SPF and DKIM results to the domain in the From header through alignment, and tells receiving servers what to do with mail that fails. ARC exists because DMARC breaks mailing lists and forwarders that legitimately modify a message in transit. BIMI is the payoff at the end: a verified brand logo in the inbox, available only once the other four are solid.
The chapter also covers DMARCbis — the newly official standard (RFC 9989, 9990, 9991, published May 2026) that formalizes years of de facto DMARC behavior into an actual IETF standard, something most existing online guides haven’t caught up to yet.