Why email authentication matters
Major mailbox providers made authentication a requirement for bulk senders, not a best practice: unauthenticated mail gets filtered or rejected outright. It’s also the lock against spoofing, stopping fraudsters from sending as your brand to your customers.
The three records in brief
- SPFA DNS record listing servers allowed to send for the domain
- DKIMA cryptographic signature receivers verify per message
- DMARCThe policy, none, quarantine, or reject, plus reporting
- AlignmentThe visible from-domain matching what SPF and DKIM validated
Questions
Where does a store set this up?
DNS records at the domain host, with values from each sending platform: the ESP, the transactional sender, the helpdesk. Every tool that sends as your domain needs covering, or DMARC will flag it.
What DMARC policy should a store run?
Start at monitoring, read the reports until legitimate senders all pass, then tighten toward quarantine and reject. Jumping straight to reject with a missed sender means your own receipts stop arriving.