Email Authentication: SPF, DKIM and DMARC Explained

What email authentication means

Email authentication is how a receiving mail server checks that a message claiming to come from your domain really came from you. Anyone can type your address into the From line of an email. Authentication gives the receiver a way to tell your newsletter apart from a forgery sent in your name.

It is done with three records you publish in your domain's DNS, the same place that tells the internet where your website lives. Together they decide much of whether your mail reaches the inbox or the spam folder.

For a small business this matters in two ways. Your own emails (quotes, invoices, booking confirmations, newsletters) need to arrive. And your customers need to be protected from someone sending fake invoices that look like they came from you.

What inbox providers now require

Authentication used to be good practice. In February 2024 the largest free inbox providers turned it into a requirement and published the rules. They split senders into two groups.

One provider's guidelines also ask for a DKIM key of at least 1024 bits and recommend 2048 bits where your sending service supports it, and they suggest keeping complaints closer to 1 in every 1,000 messages as a working target.

Most small businesses never send 5,000 messages in a day. The bulk rules are still worth meeting, because they describe what a trustworthy sender looks like.

SPF: the list of who may send

SPF (Sender Policy Framework) is a single TXT record that lists the servers and services allowed to send mail for your domain. When a message arrives, the receiver checks whether the server that delivered it is on your list.

• One record per domain. The SPF standard does not permit more than one SPF record for the same name. Two records cause an error, and receivers treat it as a failure.
• Ten lookups at most. Every include of another service counts toward a limit of ten DNS lookups. Go over it and the check fails with an error, even though every service on your list is legitimate.
• The ending matters. A record ends with -all (anything not listed fails), ~all (probably not authorized, treat with suspicion) or ?all (no opinion). Most businesses start with ~all and tighten later.

The common mistake is forgetting a sender. Your office email, your booking system, your invoicing tool and your newsletter service may all send as your domain. Each one needs to be on the list, and when a service is dropped it should come off again.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each message as it leaves the sending service. The matching public key sits in your DNS under a name called a selector, so the receiver can look it up and confirm the signature.

Two parts of the signature matter in practice. The signing domain shows whose name is taking responsibility for the message, and it should be your own domain rather than the sending service's. The selector lets you publish more than one key at once, so each service can sign with its own key and you can replace keys without downtime.

A DKIM signature can break when something changes the message on the way, such as a mailing list adding a footer. That is one reason DMARC accepts a pass from either SPF or DKIM.

DMARC: the policy and the reports

DMARC ties the other two together. It is a TXT record at _dmarc on your domain that starts with v=DMARC1 and tells receivers two things: what to do with mail that fails, and where to send reports about what they saw.

• p=none asks for no change in delivery. It is monitoring mode, and it is what the bulk sender rules accept as a minimum.
• p=quarantine asks receivers to treat failing mail as suspicious, usually by putting it in spam.
• p=reject asks receivers to refuse failing mail outright.

To pass DMARC, a message needs SPF or DKIM to pass for a domain that matches the one in the From line. This matching is called alignment. In relaxed mode, the default, mail from news.yourdomain.com aligns with a signature for yourdomain.com. In strict mode the names must match exactly.

The rua tag names an address for aggregate reports. Receivers send them as data files, usually once a day, listing every server that sent mail as your domain and whether it passed. Those reports are how you find the forgotten sender before you tighten the policy.

The order to set it up

Done in the wrong order, a strict policy can block your own invoices. Done in this order, nothing real gets lost:

• List every sender. Office mail, website forms, booking and invoicing tools, newsletters, anything that sends as your domain.
• Publish one SPF record that includes each of them, and check the lookup count.
• Turn on DKIM in each sending service so it signs as your domain, using a 2048-bit key where offered.
• Publish DMARC with p=none and a report address. Read the reports for a few weeks.
• Fix what the reports show, usually a service that is missing from SPF or is still signing with its own domain.
• Move to quarantine, then reject, once every real sender passes. The pct tag lets you apply the policy to a share of mail first.

Unsubscribes and complaints count too

Authentication proves who you are. Inbox providers also watch how people react to your mail, and the two rules that trip up small senders most are unsubscribes and spam complaints.

Marketing mail should carry a one-click unsubscribe header, which lets the inbox show its own unsubscribe button, plus a visible link in the body. Requests should be honored within 2 days. A person who cannot find the way out will press the spam button instead, and complaints above 3 in every 1,000 messages put all of your mail at risk.

The best protection is sending to people who asked for it. A list pulled from years of old records needs cleaning first: remove opted-out addresses, merge duplicates and drop addresses that bounce. The same consent thinking applies to texting, covered in our guide to text message marketing.

A sample setup conversation

Here is how a first look at a sending domain might go for a dental practice whose newsletter has been landing in spam.

Signs your authentication is broken

• Customers say quotes or invoices went to spam, or never arrived.
• Your newsletter open counts fell suddenly with no change in the content.
• Customers report emails in your name that you did not send.
• A new tool was added to send email and nobody touched DNS.
• Bounce messages mention SPF, DKIM, DMARC or a policy rejection.

Any one of these is a reason to check the three records and read the DMARC reports.

What a managed setup includes

Email is one of the channels we set up and run for clients, alongside calls, texts and website chat. Here is the email part:

• Set up the sending domain. SPF, DKIM and DMARC published the way inbox providers now require, then tested on real inboxes before the first send.
• Clean the list. Old and opted-out addresses removed and duplicates merged, from your real customer records.
• Write and send. Newsletters and campaigns go to the customers they fit, and you approve each one before it goes.
• Keep replies in one place. A reply to an email lands in the same thread as that customer's texts and calls.

Email reminders and follow-ups work best when they arrive alongside fast replies on every channel, which our guide to lead follow-up automation and our look at managed AI services versus DIY tools cover. See what we build, or call (423) 574-4514 and ask our AI agent how it would work for your business.

Frequently asked questions

Keep reading

Where this fits in what we build: What we build