Email authentication is a set of standards that let receiving servers check whether an email really comes from the domain it claims. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and sends you reports. All three are published as DNS records on your domain.
The three records
- SPF (RFC 7208): a TXT record listing authorized senders. Receivers check the envelope sender domain against it. SPF has a limit of 10 DNS lookups, which many SaaS stacks hit.
- DKIM (RFC 6376): your sending service signs each message with a private key; the public key is published in DNS under a selector.
- DMARC (RFC 7489): a TXT record at _dmarc.yourdomain that sets a policy (none, quarantine or reject) and a reporting address. It passes when SPF or DKIM passes and aligns with the From domain.
example.com. TXT "v=spf1 include:_spf.google.com include:mail.example-esp.com ~all"
selector1._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Rolling out DMARC safely
Start with p=none to collect reports without affecting delivery. Use the aggregate reports to find every service sending as your domain: marketing platform, CRM, support desk, billing, product notifications. Fix their SPF or DKIM alignment, then move to quarantine and eventually reject. Skipping straight to reject can silently block legitimate mail.
Why it matters now
Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders since 2024, and Microsoft set similar requirements for Outlook consumer domains in 2025. Authentication also protects your brand from spoofing, and a DMARC policy at enforcement is a prerequisite for showing a brand logo through BIMI with some providers.
Example
Finding forgotten senders
Hypothetical company Thistlegarth publishes DMARC at p=none and finds in the reports that its billing tool and an old webinar platform send as its domain without DKIM. It sets up DKIM for billing, retires the webinar tool, and moves to quarantine a month later.
Common mistakes
Multiple SPF records
A domain must have only one SPF record. Two records cause SPF to fail. Merge them into one.
Questions
Yes, for bulk sending to Gmail and Yahoo, and it is good practice anyway. DMARC checks alignment with the visible From domain, which SPF and DKIM alone do not.
