Email authentication: SPF, DKIM, DMARC, and BIMI

Email authentication is a set of DNS-based standards that let a receiving server answer one question: did this message really come from the domain it claims to? Without it, anyone can put your domain in the Fromaddress. With it, receivers can verify the sender and detect tampering — which is why it’s the foundation of both deliverability and anti-spoofing.

There are three core pieces — SPF, DKIM, and DMARC — plus BIMI, which builds on top to show your logo. You want all three core records in place.

SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for your domain. A receiver looks it up and checks whether the connecting server is on the list.

v=spf1 include:amazonses.com include:_spf.google.com -all

The catch: SPF allows a maximum of 10 DNS lookups, and it doesn’t survive forwarding — which is exactly why DKIM and DMARC exist alongside it. Build a valid record with the SPF record generator.

DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key. The matching public key is published in DNS, so receivers can verify the signature — proving the message genuinely came from your domain and wasn’t changed in transit.

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Generate a keypair and the matching record with the DKIM record generator — the private key is created in your browser and never sent anywhere.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer. It requires SPF or DKIM to not only pass but align with your From domain, tells receivers what to do when a message fails (none, quarantine, or reject), and sends you reports about who’s sending as you.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Always start at p=none with a reporting address, watch the reports, then escalate to quarantine and reject. Build it with the DMARC record generator.

BIMI (Brand Indicators for Message Identification) is the optional fourth piece: once you’re at DMARC enforcement, it lets your brand logo appear next to your messages. It needs an SVG logo over HTTPS and, for Gmail and Apple Mail, a paid Verified Mark Certificate. Build the record with the BIMI record generator.

Since February 2024, Gmail and Yahoo require anyone sending in volume to authenticate with all three — SPF, DKIM, and DMARC — and bulk senders must also keep spam complaints low and support one-click unsubscribe. Below those thresholds the rules are softer, but the same authentication is still what keeps you out of spam.

In short: SPF, DKIM, and DMARC aren’t optional any more. They’re the price of entry.

1. Publish an SPF record listing every service that sends for you, ending in ~all while you confirm it, then -all.
2. Add DKIM signing and publish the public key, so messages are signed and verifiable.
3. Publish a DMARC record at p=none with a rua address and read the reports.
4. Once your legitimate mail passes and aligns, move DMARC to quarantine, then reject. Add BIMI last if you want your logo shown.