Email authentication
What is email authentication?
Email authentication consists of a set of techniques that verify if emails actually come from the domain they claim to. It helps prevent spoofing and phishing by confirming the sender's legitimacy.
Why is email authentication important?
- Protects against impersonation
Bad actors often try to send emails that look like they come from a trusted brand. Authentication helps stop such attempts before they reach the inbox. - Required by email providers
Services like Google, Yahoo, and Outlook have mandated email authentication for all senders. Without it, emails are likely to be filtered into spam or rejected. - Helps you stay compliant
Many data protection and anti-spam regulations (like GDPR and CAN-SPAM) require that businesses implement secure practices, and email authentication plays a key role in that. - Builds credibility
Proper authentication indicates legitimate sources, which builds a good domain reputation. This consistency improves overall deliverability.
How is email authentication implemented?
The three pillars of email authentication are — SPF, DKIM, and DMARC, which are published in the sender's DNS server. When a recipient receives an email, it checks these DNS records. If the email passes authentication, it's delivered to the inbox. If not, it may be marked as spam or rejected depending on the DMARC policy.
SPF (Sender Policy Framework) - Specifies which servers are allowed to send emails on behalf of your domain. This helps the recipient verify if the sender is valid.
DKIM (DomainKeys Identified Mail) - Adds a digital signature to each email, ensuring the message hasn't been altered in transit. This prevents attackers from adding malicious links to emails en route.
DMARC (Domain-based Authenticating, Reporting, and Conformance) - Builds on SPF and DKIM. It specifies what the recipient should do if the authentication fails: accept, quarantine, or reject.
Additionally, you can implement BIMI (Brand Indicators for Message Identification) to your emails. BIMI is a standard that works along with DMARC to display your brand's logo in supported inboxes. While not a core authentication mechanism, this helps implement brand visibility and trust once SPF, DKIM, and DMARC are implemented.
Best practices
- Implement all three standards for complete protection.
- Monitor DMARC reports regularly to detect suspicious activity.
- Rotate DKIM keys periodically to maintain security.
- Update your records when you change your domain or service provider.
How to check email authentication?
Once you've added your records, you can confirm if they're set up correctly in a couple of ways:
- Manually: Send a test email from your service. Open the message you've received and click on "Show original" or "View message source". In the header, look for the SPF, DKIM, and DMARC sections. If they're configured correctly, you will see them marked as "pass".
- Online tools: Instead of the manual method, you can also use online tools like MX Toolbox, Google Admin Toolbox, Zoho Toolkit, DNS Checker, and DMARCian.