Email authentication boils down to three DNS records that together prove you're actually allowed to send mail from your own domain: SPF, DKIM, and DMARC. Without them in place, mailbox providers have no way to tell you apart from someone spoofing your domain, so by default they treat you as suspicious.
As of 2026, this isn't optional anymore. Google and Microsoft effectively require authentication from anyone sending at any real volume. If you take away one thing from this guide, let it be this: get all three set up before you send a single cold email.
Why authentication matters at all
Email as a protocol was never built with identity verification in mind. Anyone can drop your domain into the from field of a message. Authentication is the layer that got bolted on afterward to fix that gap, and it answers exactly one question for the receiving server: is this sender genuinely allowed to send for this domain.
If the answer is yes, you clear the first real trust hurdle. If the answer is no, or unknown, you get filtered out before your actual content is ever read. Authentication on its own won't land you in the inbox — but not having it will absolutely keep you out.
SPF, explained
SPF, short for Sender Policy Framework, is a DNS record listing exactly which servers are authorized to send email for your domain. When a receiving server gets your mail, it checks the sending server against your SPF record to see if it's on the approved list.
SPF lives as a single TXT record on your domain. The most common mistake is ending up with more than one SPF record, or blowing past the lookup limit by stacking too many sending services into it. You get exactly one SPF record, and every sending tool you use needs to be folded into that same one.
DKIM, explained
DKIM, short for DomainKeys Identified Mail, attaches a cryptographic signature to every email you send. The receiving server checks that signature against a public key published in your DNS. When they match, the message is confirmed as genuinely from you and unaltered along the way.
DKIM gets published as a DNS record under a selector subdomain, and the actual value is typically supplied by your email service. Each sending platform generally uses its own DKIM key, so if you're sending through more than one tool, each one needs its own DKIM record published separately.
DMARC, explained
DMARC — Domain-based Message Authentication, Reporting and Conformance — ties SPF and DKIM together into one policy. It's a DNS record that tells receiving servers exactly what to do when a message fails authentication: let it through, quarantine it, or reject it outright.
DMARC also turns on reporting, giving you visibility into who's sending mail using your domain. For cold email, start with a monitoring-only policy so you can watch what's happening and confirm your own legitimate mail is passing, then tighten it from there. Publishing an aggressive reject policy before your own mail is confirmed passing will simply block your own campaigns.
Setting each one up
All three live as DNS records added through your domain registrar or DNS host. The specific values come from your email provider, but the order you add them in genuinely matters.
- SPF first. Create one TXT record covering every service you send through. Double-check it's a single record and not a duplicate.
- DKIM second. Pull the DKIM record from each sending platform and publish it at its selector. Confirm each one actually resolves.
- DMARC last. Only add the DMARC record once SPF and DKIM are both passing, and start with a monitoring policy. Tighten it once you've confirmed your legitimate mail is passing cleanly.
Once all three are live, verify them with the free SPF, DKIM and DMARC checker. It tests against the common DKIM selectors and shows you exactly which records are passing.
Making sense of the results
A clean setup shows SPF passing, DKIM passing, and a DMARC record that's both present and aligned. You can double-check this against real mail too, by opening the raw headers of a test email and reading the authentication results line directly. The free email header analyzer parses that for you automatically.
Watch for the word alignment. SPF and DKIM can technically both pass and DMARC can still fail if the domains involved don't align with each other. If DMARC shows a failure despite SPF and DKIM passing individually, misalignment is almost always the reason why.
Failures people run into
- Two SPF records. Only one is allowed. A leftover second record, often forgotten from an old tool, invalidates both.
- SPF lookup limit exceeded. Too many included services push you past the limit, and SPF fails without any visible warning.
- Missing DKIM for a newly added tool. You connected a new sending platform but never published its DKIM record, leaving its mail unsigned.
- DMARC set too aggressively too soon. A reject policy published before your own mail passes will block your own campaigns outright.
- A record that quietly broke. DNS changes fail silently. Re-check your authentication periodically, not just once during initial setup.
Authentication is the cheapest, fastest win in deliverability, and also the easiest one to overlook entirely. Once it's solid, move on to the rest of the system with the deliverability guide, and get your accounts properly warmed up with the warmup guide.