How email gets to where it needs to go
SPF record provides a list of all authorized senders while MX describes the routing.
These records are telling email servers if you are sending to an email address at frii.day then send to mx1.simplelogin.co., if that fails then send to mx2.simplelogin.co. frii.day MX 20 mx2.simplelogin.co. frii.day MX 10 mx1.simplelogin.co.
Confidentiality, Integrity, Availability
It's an authentication mechanism based on addressing to prove a server sending emails is allowed to send emails on behalf of the domain the email addresses belong to.
This is a DNS recorded the domain owner (who is creating the SPF record) must add to authorize the email providers SENDING email servers to send on behalf of the person creating the DNS record.
The RECEIVING mail server will then resolve the SPF DNS record to prove the domain author authorized the SENDER server.
The first part of the content value for the SPF DNS record is the email servers listed via ip or DNS that are allowed to send email on your behalf.
So if you are frii.day and you want simplelogin to be able to send an email on your behalf your SPF record might look like:
v=spf1 include:simplelogin.co ~all
The ~all is a rule that is telling the receiving server that if the email fails SPF then you may want to be careful. It's a soft failure vs a hard failure -all which says bad guy detected garenteed if this SPF fails.
It's an authentication mechanism based on cryptography to prove a server sending emails is allowed to send emails on behalf of the domain the email addresses belong to.
Gives the RECEIVING server dns records to lookup to gain access public key matching the SENDING servers private key. The RECEIVING server will use this public key to:
You will likely have more than DKIM cryptographic key. Having more than one valid cryptographic key isn't part of the DKIM standard but it helps operationally for example: shift your keys through a queue so they can end up in stages like "up for adoption", "active key", "pending retirement". This lets the sending mail servers perform the rotation while the receiving email servers can lookup the DNS records cantaining the new keys gracefully as email delivery can be delayed by hours or even days and the DNS caches (pointing to the cryptographic keys) also have their own TTLs.
DMARK is the ruleset that happens after DKIM or SPF fail. It also includes an additional comparision check to ensure the "From" address domain matches the SPF and DKIM DNS records.
The additional "From" address check is required because SPF and DKIM only prove identity of the sending email server and the integrity of the email content. What it doesn't prove is that the "From" address in the email header matches the email domain.
Bounce address is the SMTP Server (SENDERs server) MAIL FROM address. Bounce address is the email address that the email gets delivered to should the delivery fail for some reason. This allows for the sender server to track failed deliveries.
DMARK only Needs SPF or DKIM to pass due to two use-cases, email forwarding and mailing lists. However the "From" address always needs to match.
Only SPF or DKIM is usually required to pass for the email to be accepted because of email forwarding. Should an email be forwarded through another email server then the sender will fail SPF but will still be accepted because DKIM proves its still a legit email.
Likewise if DKIM failed its likely because the sender had a legit reason to modify the message for example in the case of mailing lists. For example, appending a message like: "you are receiving this because you subscribed to ....". Note: a mailing list is an email address that you send emails too and it broadcasts that email message to everyone in the list associated with that mailing list email address
Spam filters are a receiving server problem so you can still host your own email server if you want to manage your accounts with it or your contacts are using the same server.