Email Authentication
Email authentication proves mail is really from you via SPF, DKIM, and DMARC, now required by major mailbox providers.
What email authentication is
Email authentication is proving your email is really from you: SPF authorizes which servers may send for the domain, DKIM signs messages so tampering shows, and DMARC tells receivers how to treat mail that fails, with reports back to you.
Why email authentication matters
Major mailbox providers made authentication a requirement for bulk senders, not a best practice: unauthenticated mail gets filtered or rejected outright. It’s also the lock against spoofing, stopping fraudsters from sending as your brand to your customers.
The three records in brief
- SPF: a DNS record listing servers allowed to send for the domain
- DKIM: a cryptographic signature receivers verify per message
- DMARC: the policy, none, quarantine, or reject, plus reporting
- Alignment: the visible from-domain matching what SPF and DKIM validated
Frequently asked questions
Where does a store set this up?
DNS records at the domain host, with values from each sending platform: the ESP, the transactional sender, the helpdesk. Every tool that sends as your domain needs covering, or DMARC will flag it.
What DMARC policy should a store run?
Start at monitoring, read the reports until legitimate senders all pass, then tighten toward quarantine and reject. Jumping straight to reject with a missed sender means your own receipts stop arriving.
Related terms
Email Deliverability · Email Marketing · Transactional Email