Email was designed in an era when every sender was trusted. As a result, the address shown in the "From" line can be forged with very little effort. Email authentication gives receiving servers a way to check whether a message claiming to come from your domain is genuine.

SPF: who is allowed to send

A Sender Policy Framework record is a DNS entry listing the servers permitted to send mail for your domain, such as your email platform and your marketing service. Receiving servers compare the sending server against this list. Keep the record accurate and within the DNS lookup limit, and update it whenever you add a new sending service.

DKIM: proof the message was not altered

DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. The receiving server uses a public key published in your DNS to verify the signature, confirming that the message came from an authorized system and was not modified in transit.

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM to the visible "From" domain and tells receivers what to do with messages that fail: deliver them, quarantine them or reject them. DMARC also sends reports showing who is sending email using your domain, which often reveals forgotten services as well as impersonation attempts.

Rolling out DMARC safely

  1. Publish a monitoring policy (p=none) and collect reports.
  2. Identify every legitimate sender and fix its SPF and DKIM setup.
  3. Move gradually to quarantine, then to reject, once legitimate mail passes consistently.

The business benefits

Authentication makes it harder for criminals to send convincing invoices or payment requests in your name, protecting your customers and your reputation. Major mailbox providers also expect bulk senders to authenticate their mail, so correct setup supports deliverability for newsletters and transactional emails. It does not guarantee inbox placement, but missing records are a common, avoidable reason for rejection.

If your records are missing or you are unsure whether they are correct, our business email team can review and configure them.