Email Authentication: How SPF, DKIM, DMARC, and BIMI Work

Email authentication is a set of technical checks that connects an email to an authorized sending domain. SPF checks sending infrastructure, DKIM verifies a cryptographic signature, and DMARC evaluates whether either authenticated domain aligns with the address visible to the recipient.

Authentication protects your domain from direct spoofing and gives mailbox providers better evidence when filtering mail. It is only one part of deliverability: reputation, consent, list quality, content, and recipient engagement still matter.

What is email authentication and why do you need it?

Email authentication lets a receiving server check whether the infrastructure and domains used by a message match rules published by the domain owner. These checks make impersonation harder and help legitimate senders establish a consistent identity.

The main benefits are:

• Domain protection. DMARC can tell participating receivers to quarantine or reject messages that spoof your domain.
• Better visibility. Aggregate DMARC reports reveal which services send mail using your domain and where authentication fails.
• More dependable delivery signals. Correct authentication prevents avoidable failures, although it cannot compensate for poor reputation or unsolicited mail.
• Support for provider requirements. Major mailbox providers require authentication for many senders, with stricter rules for bulk traffic.

Business email compromise remains a major risk. The FBI Internet Crime Report illustrates the financial impact, but authentication should be treated as one layer in a broader security program rather than a complete defense.

SPF, DKIM, DMARC, and BIMI at a glance

How email authentication works

When a message arrives, the receiving server can evaluate several identities. The visible From address is what readers see, but SMTP also carries an envelope sender, often exposed as the Return-Path. DKIM adds a signing domain in the d= tag. DMARC connects these otherwise separate checks through alignment.

1. The sending service connects to the receiving mail server.
2. The receiver checks SPF against the envelope sender or HELO domain.
3. The receiver retrieves the DKIM public key from DNS and verifies the message signature.
4. DMARC checks whether the domain that passed SPF or DKIM aligns with the visible From domain.
5. The receiver combines authentication results with reputation and other filtering signals, then delivers, filters, quarantines, or rejects the message.

SPF: authorize sending sources

SPF is evaluated against the SMTP envelope sender domain, not simply the visible From address. Publish a single SPF TXT record for each sending domain and include every legitimate service that uses it. Multiple SPF records can cause a permanent error.

SPF processing has a limit of 10 DNS-querying mechanisms and modifiers. Excessive nested include chains can exceed that limit. Forwarding can also break SPF because the forwarding server’s IP may not be authorized, which is one reason aligned DKIM is valuable.

A basic record might look like v=spf1 include:example-email-service.com -all. Use the exact value supplied by each provider and audit the record before removing or adding sources.

DKIM: sign the message

DKIM does not encrypt the private key or the message. The sending system keeps the private key and uses it to create a signature. The receiver retrieves the public key from DNS and checks whether the signature is valid for the signed headers and body.

A valid signature shows that the signed content has not been altered and that the signer controlled the private key associated with the DKIM domain. It does not automatically prove that the message is trustworthy. For DMARC, the DKIM d= domain must also align with the visible From domain.

DMARC: align identities and publish a policy

DMARC evaluates aligned SPF and DKIM, then applies the domain owner’s requested policy: monitoring with p=none, spam-folder treatment with p=quarantine, or rejection with p=reject. Receivers retain final control over handling.

Start with reporting, inventory every legitimate sender, fix alignment, and only then increase enforcement. A starter record can be v=DMARC1; p=none; rua=mailto:dmarc@example.com. Use a dedicated, monitored reporting mailbox or a reporting service.

Current DMARC guidance is defined in RFC 9989. For a complete rollout, see our DMARC setup process.

BIMI: add a verified brand indicator

BIMI is not a replacement for SPF, DKIM, or DMARC. The organizational domain generally needs DMARC enforcement, and the logo must use the required SVG Tiny Portable/Secure profile. Some providers also require a Verified Mark Certificate or Common Mark Certificate and apply their own reputation and display rules.

A record can point to the hosted logo and certificate: v=BIMI1; l=https://yourserver.com/logo.svg; a=https://yourserver.com/vmc.pem. Publishing the record does not guarantee that every inbox will show the logo.

How to set up email authentication safely

Treat authentication as an inventory and verification project, not a sequence of DNS records copied blindly. Use a subdomain for marketing mail when that separation supports your domain strategy, and coordinate changes with every team or vendor that sends on your behalf.

1. Inventory every sending source

List your email service provider, corporate mail, transactional systems, support platform, CRM, billing tools, and any service that sends with your domain in the visible From address. Check old systems too: an unknown legitimate sender is a common reason DMARC enforcement breaks mail.

2. Publish one accurate SPF record

Add only authorized sources, keep the record within the DNS-lookup limit, and remove services you no longer use. DNS panels publish the record; you normally do not need to “restart” DNS. Allow time for caches to expire.

If your DNS host requires provider-specific instructions, its interface may differ. This DNS record reference is one example; follow the documentation for your own provider.

3. Enable DKIM for every service

In Selzy or another ESP, generate or copy the provider’s DKIM DNS record, publish it under the exact selector, and then return to the provider to verify it. Each service may use its own selector, so multiple DKIM records can coexist.

For Selzy, follow the current account prompts, review the general guide on how to set up your email, and use our detailed article on how to set up DKIM for your domain.

4. Add DMARC in monitoring mode

Publish a DMARC TXT record at _dmarc.yourdomain.com, collect aggregate reports, and verify that legitimate sources pass aligned SPF or DKIM. Move gradually from p=none to p=quarantine and then p=reject only when reports show that expected traffic is aligned.

5. Add BIMI after DMARC enforcement

Prepare a compliant SVG logo, host it over HTTPS, publish the BIMI record, and obtain a supported mark certificate if your target mailbox providers require one. Confirm that the domain’s DMARC policy and reputation meet each provider’s display criteria.

How to verify and troubleshoot authentication

Send a test message to accounts at several mailbox providers and inspect the full headers. Look for Authentication-Results entries showing SPF, DKIM, and DMARC outcomes. Also use your ESP’s domain-status checks and review DMARC aggregate reports over time.

Email authentication checklist

• Inventory every system that sends with your domain.
• Publish one valid SPF record and stay within the lookup limit.
• Enable DKIM for every sending service and verify the selector.
• Confirm that SPF or DKIM aligns with the visible From domain.
• Start DMARC with reporting, then progress carefully to enforcement.
• Test real messages and monitor authentication results continuously.
• Add BIMI only after the authentication foundation is stable.

Email authentication works best as an ongoing control. Recheck records whenever you add or remove a vendor, rotate DKIM keys periodically, monitor DMARC reports, and keep ownership of sending domains and DNS access clearly documented. When you are ready to send authenticated campaigns, start with Selzy.