Email authentication is a set of standards that verify a sender is who they claim to be, using DNS records that receiving mail servers check before delivering messages. The three core protocols, SPF, DKIM, and DMARC, work together to prove your emails are legitimate and stop spammers from spoofing your domain.

Google and Yahoo started enforcing stricter authentication requirements for bulk senders in 2024, and unauthenticated mail now lands in spam or gets blocked outright. This guide covers how each protocol works, how to set them up correctly, and how to fix common failures that hurt your deliverability.

Email authentication is a set of standards that verify a sender is who they claim to be. When you send an email, the receiving mail server checks DNS records on your domain to confirm the message came from an authorized source. Pass the check, and your email lands in the inbox. Fail it, and you’re headed to spam or blocked entirely.

Three protocols do the heavy lifting: SPF (which lists approved sending servers), DKIM (which adds a digital signature), and DMARC (which tells receiving servers what to do when checks fail). Together, they form a verification system that mailbox providers like Gmail and Yahoo rely on to filter out spoofed messages.

If you’re running cold outreach, this matters more now than it did a year ago. Google and Yahoo rolled out stricter requirements for bulk senders in early 2024, and unauthenticated mail often never reaches the inbox at all.

Without authentication, anyone can send emails that look like they came from your domain. Spammers do this constantly, which is why mailbox providers treat unauthenticated messages with suspicion.

Here’s what proper authentication actually protects:

We’ve seen teams with strong messaging and clean lists still struggle with replies because their authentication was misconfigured. The technical setup comes first. Copy comes second.

Think of SPF, DKIM, and DMARC as three checkpoints your email passes through. Each one verifies something different, and together they give mailbox providers confidence that your message is legitimate.

SPF and DKIM can pass independently, but DMARC requires alignment. The domain in your SPF or DKIM record has to match the domain your recipient sees in the “From” field. This alignment requirement is what actually stops spoofing.

SPF (Sender Policy Framework) is a DNS record that lists every server authorized to send email on behalf of your domain. When a receiving server gets your message, it compares the sending IP against your SPF record. Match? Pass. No match? Fail.

The record itself is a TXT entry in your DNS. Here’s an example:

This authorizes Google Workspace and SendGrid to send for your domain. The -all at the end means “reject anything from servers not on this list.”

One thing to watch: SPF has a 10 DNS lookup limit. If you’re using multiple email tools (CRM, marketing platform, outreach tool), you can hit that ceiling fast. Go over, and SPF fails entirely.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your email headers. Your sending server signs each message with a private key, and the receiving server verifies it using a public key published in your DNS.

If the signature matches, the receiving server knows two things: the email genuinely came from your domain, and nobody tampered with it in transit.

Setting up DKIM typically involves generating a key pair through your email provider, then adding the public key as a DNS TXT record at a specific subdomain called a selector. Most providers walk you through this process, and once it’s configured, signing happens automatically. Unlike SPF, DKIM survives forwarding better, which is why having both matters.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together with a policy layer. It tells receiving servers what to do when authentication fails and sends you reports on who’s attempting to use your domain.

You have three policy options:

Most teams start with p=none to collect data before enforcing. The reports show every source attempting to send as your domain, whether legitimate or not. After a few weeks of monitoring, you can tighten the policy.

A basic DMARC record looks like this:

The rua tag specifies where aggregate reports get sent. Free tools like Google Postmaster Tools help you interpret them.

Beyond SPF, DKIM, and DMARC, a few additional protocols exist. They’re less common in outbound sales contexts but worth knowing about.

BIMI (Brand Indicators for Message Identification) displays your brand logo next to authenticated emails in the inbox. It requires a DMARC policy at enforcement level (quarantine or reject) and a verified logo file. Nice for brand visibility, though not a deliverability factor itself.

ARC (Authenticated Received Chain) preserves authentication results when emails pass through forwarding services or mailing lists. Without ARC, legitimate forwards often break SPF and DKIM. Mail servers handle ARC automatically, so it’s not something you configure directly.

MTA-STS and TLS reporting enforce encrypted connections between mail servers. They’re more relevant for enterprise security teams than for outbound sales, but they exist as part of the broader authentication ecosystem.

Log into your DNS provider and add a TXT record for your domain. Include every service that sends email on your behalf. Your email provider (Google Workspace, Microsoft 365, etc.) will give you the exact syntax to use.

Test with a free tool like MXToolbox to confirm the record is published and valid.

Your email provider generates the key pair. Copy the public key they provide and add it as a TXT record at the selector subdomain they specify (usually something like selector1._domainkey.yourdomain.com).

Once published, your provider handles signing automatically.

Start with a monitoring policy:

Add this as a TXT record at _dmarc.yourdomain.com. After collecting reports for a few weeks, you can move to quarantine or reject.

Send test emails to mail-tester.com or use MXToolbox’s email header analyzer. Check that SPF, DKIM, and DMARC all show “pass” in the results.

Authentication failures usually trace back to a few predictable causes:

Your DMARC reports are the diagnostic tool here. They show exactly which sources are failing and why. Review them weekly, especially after adding new sending tools.

Google and Yahoo now require SPF, DKIM, and DMARC for anyone sending bulk email. The rules apply to cold outreach, not just marketing newsletters.

The key requirements include valid authentication across all three protocols, easy one-click unsubscribe for marketing messages, and spam complaint rates below 0.3%. If you’re sending cold emails at any real volume, failing to meet these requirements means your messages get throttled or blocked.

Run outbound from a subdomain or entirely separate domain, not your primary company domain. If deliverability issues occur, your main domain stays protected. For example, if your company is acme.com, send cold outreach from outreach.acme.com or acme-mail.com.

New domains and mailboxes have zero reputation. Sending high volume immediately triggers spam filters.

Gradually increase volume over 2–4 weeks while generating real engagement signals. Tools like lemwarm automate this by exchanging emails with real inboxes at a controlled pace, building sender reputation before you start campaigns.

Gmail-to-Gmail and Outlook-to-Outlook routing tends to perform better than cross-provider sending. Some platforms handle this routing automatically based on recipient domain.

Ongoing monitoring catches issues before they hurt deliverability. Set a calendar reminder to review aggregate reports and spot unauthorized senders or authentication failures early.

DNS configuration intimidates a lot of sales teams, and honestly, it’s easy to misconfigure. One wrong character in a TXT record and your authentication breaks.

If you’d rather skip the manual setup, platforms like lemlist handle domain purchasing, authentication configuration, warmup, and ongoing monitoring in one place through the Deliverability Hub. You get visibility into mailbox health, alerts when something breaks, and recommendations to fix issues before they affect your campaigns.

Publish SPF, DKIM, and DMARC records in your domain’s DNS settings, then verify they’re working with a free testing tool like MXToolbox or mail-tester.com.

The most common causes are exceeding the SPF lookup limit, forgetting to include a third-party sending service, or alignment mismatches where your “From” domain doesn’t match your authenticated domain.

Technically yes, but your messages will likely land in spam or get rejected entirely. Gmail, Yahoo, and other major providers now require authentication for bulk senders.

DNS changes typically propagate within a few hours, though some providers take up to 48 hours. You can verify records are live using online DNS lookup tools.