SPF, DKIM and DMARC: Complete Guide for CISSP
Email authentication for the CISSP: what SPF, DKIM and DMARC each check, why forwarding breaks SPF, and how alignment ties a pass to the visible From.
CISSP Domain 4: Communication and Network Security
How traffic is carried, protected and separated: the OSI model layer by layer, the protocols that encrypt data in transit, the authentication that stops a forged sender, and segmentation from VLANs up to micro-segmentation so that one breach cannot reach everything.
What the exam outline covers
The ISC2 CISSP exam outline lists these areas for Domain 4 and gives the domain a weighting of 13%. The wording below is a plain-English paraphrase; the outline itself is the source.
- Secure design principles in network architectures, including the OSI and TCP/IP models
- Secure network components: firewalls, switches, routers and endpoints
- Secure communication channels: voice, remote access, data and virtualised networks
Articles
IPsec AH vs ESP: What Is the Difference?
AH authenticates but never encrypts and breaks through NAT. ESP encrypts, authenticates and traverses NAT. A CISSP insight on the IPsec protocol choice.
Certificate Pinning: What Should You Pin First?
The foundational certificate pinning decision: choosing between certificate fingerprints, public key hashes and chain elements. A CISSP exam insight.
Key terms
Seven-layer reference model, physical to application, used to place every protocol, device, and attack at the layer where it operates; the exam's favourite classification framework.
Layer 3 protocol suite securing IP traffic: AH gives integrity and origin authentication only, ESP adds confidentiality, and tunnel mode wraps the whole original packet for VPNs.
Protocol encrypting sessions above the transport layer: an asymmetric handshake authenticates the server and agrees symmetric session keys; the deprecated predecessor is SSL.
Encrypted tunnel carrying private traffic across untrusted networks; site-to-site links join whole networks through gateways, remote access serves single users, over IPsec or TLS.
Layer 2 logical segmentation that splits one physical switch fabric into isolated broadcast domains via 802.1Q tags; separation without new hardware, subverted by VLAN hopping.
Dividing a network into isolated zones so compromise of one cannot spread laterally; spans physical separation, logical VLANs and firewalls, and workload micro-segmentation.
Architecture separating the control plane from the data plane: a centralised programmable controller sets forwarding policy network-wide, and becomes its highest-value target.
Admission control that authenticates devices and checks their security posture before granting network access, typically via 802.1X, shunting failures to a quarantine VLAN.
The internet's distributed naming service, resolving names to addresses. It is unauthenticated by default, which is why DNSSEC signs records and why poisoning and tunnelling remain testable.
DNS record listing the servers authorised to send mail for a domain. The receiver checks the connecting IP against the envelope sender's record, so it authenticates the path, not the visible From.
A cryptographic signature over an email, verified against a public key in DNS. It proves integrity and which domain signed, provides no confidentiality, and survives a plain forward.
The policy layer that tests whether an SPF or DKIM pass aligns with the visible From domain, tells receivers what to do when neither does, and requests reports from them.
Forging the sender identity on a message. SMTP verifies neither the envelope sender nor the visible From, so the three forms differ in whether authentication can address them at all.
Hardcoding which certificate or public key a client will accept for a service, so a fraudulent certificate from a compromised CA is rejected even though it validates normally.
Reading is half of it. Scenario questions in this domain tend to turn on the distinctions above, and the quickest way to find out which ones you hold is to answer some. The CISSP practice tests cover all eight domains with an explanation for every answer, and the free assessment gives you a baseline first.