Email Authentication for Marketers

tl;dr;
Email Authentication Diagram
Diagram of the email authentication process.

Why Care?

  • Prevent brand impersonation: Ensure that only authorized senders can send emails on behalf of your domain. Spoofed emails can tank your brand's reputation and spam rate.
  • Improve deliverability: Authenticated emails are less likely to be classified as spam.
  • Sender Requirements: Google & Yahoo! now require DMARC for bulk email sending.
  • BIMI: Display your brand logo in supporting email clients.

Email Authentication Protocols

SPF

Sender Policy Framework verifies if an email came from a valid source. The email sender is sending emails using an IP address, and the receiver can check if the IP address is included in the SPF policy.
v=spf1 include:_spf.google.com include:salesforce.com ip4:1.2.3.0/24 ~all
Example SPF record allowing emails to be sent from Google Workspace, and Salesforce and the IP range 1.2.3.0/24.
The include: statements allow dynamic lookups. When setting up SPF for each vendor, you usually include their specific include: mechanism.

DKIM

DMARC

Domain-based Message Authentication, Reporting, and Conformance sits on top of DKIM and SPF and does three things:
  • Alignment: Ensure that the "From:" and the "Return-Path" domains match.
  • Enforcement: Specify how failing emails should be handled. Either do nothing, quarantine, or block.
  • Reporting: Receive daily reports with the status of your email authentication.

Rolling out DMARC

Conclusion