What is email authentication?

Email authentication is the set of DNS-based standards (SPF, DKIM and DMARC) that let a receiving mail server verify that a message really comes from the domain it claims to come from and was not altered on the way. It is the baseline mailbox providers check before they consider reputation or content.

TL;DR

SPF: lists which servers may send for your domain.
DKIM: cryptographically signs each message so the receiver can verify the domain and that the content was not changed.
DMARC: requires SPF or DKIM to pass and align with the visible From domain, tells receivers what to do on failure, and sends you reports.
Required: since 2024 Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders, and Microsoft announced similar requirements for Outlook.com in 2025.

Why it matters for a B2B pipeline

Unauthenticated mail is treated as suspicious by default and increasingly rejected outright. For outbound, broken authentication is the one deliverability problem that no copy or list quality can compensate for. It also protects the brand: without DMARC enforcement, anyone can send phishing that appears to come from your domain, which damages trust with customers and prospects alike.

Example

A team adds a new sequencing tool and starts sending from it without adding the tool’s DKIM key or custom return-path. SPF passes for the tool’s own domain and DKIM is signed with the tool’s domain, so neither aligns with the From address. DMARC fails, and Gmail starts routing the mail to spam even though “SPF passed”. Publishing the DKIM key for the sending domain fixes alignment.

How to set it up and check it

Use separate sending domains for cold outbound, never your main domain or a subdomain of it, and authenticate each one fully.
Publish one SPF record per domain covering every service that sends, within the 10 DNS lookup limit.
Enable DKIM in every sending tool with a 2048-bit key where supported, using your domain, not the vendor’s.
Publish DMARC, starting at p=none with reporting, then move to quarantine or reject once all legitimate sources pass.
Verify in headers: send a test to Gmail, open “Show original”, and confirm SPF, DKIM and DMARC all show PASS.
Re-check after every DNS or tool change, and monitor DMARC aggregate reports.

Tool categories: DNS checkers (MXToolbox, dig), DMARC report processors, and Google Postmaster Tools.

Common mistakes

Two SPF records on one domain, which breaks both.
Using the sending tool’s default DKIM domain, so DMARC alignment fails.
Jumping straight to p=reject before inventorying every legitimate sender.
Treating “authenticated” as “deliverable”; authentication is necessary, not sufficient.

Email authentication