Domain identity
Authentication helps separate authorized mail from spoofed mail.
Mailvovo guide
Email Authentication Basics
Understand how SPF, DKIM and DMARC work together to protect domain identity and improve email authentication.
What is email authentication?
Email authentication is a set of DNS and message-signing checks that help receiving mail systems decide whether a message is allowed to use a domain identity. It does not make every message safe, but it creates evidence that can be checked consistently.
Why email authentication matters
Clear diagnostics
SPF, DKIM and DMARC results make failures easier to investigate.
Provider requirements
Major mailbox providers increasingly expect authenticated mail.
SPF explained
SPF is a DNS TXT record that lists which servers or services are allowed to send mail for a domain. Receivers compare the message's envelope sender with the connecting mail server. A domain should usually have one effective SPF record, and existing mechanisms should be merged rather than overwritten blindly.
DKIM explained
DKIM adds a cryptographic signature to a message. The sender publishes a public key in DNS, and the receiver checks whether the message still matches the signature. DKIM is especially useful because it can survive forwarding paths where SPF may not align.
DMARC explained
DMARC connects SPF and DKIM to the visible From domain. It also lets domain owners publish a policy such as monitoring, quarantine, or reject and receive aggregate reports from participating receivers.
How SPF, DKIM and DMARC work together
| Protocol | What it checks | Why it matters |
|---|---|---|
| SPF | Whether a sending server is authorized for the envelope sender. | Helps detect unauthorized sending infrastructure. |
| DKIM | Whether the message has a valid domain signature. | Provides message-level evidence that can support alignment. |
| DMARC | Whether SPF or DKIM passes and aligns with the visible From domain. | Turns authentication evidence into domain policy and reporting. |
What alignment means
Alignment means the authenticated identity is connected to the visible From domain that recipients see. DMARC can pass when either SPF aligns with the From domain or DKIM aligns with the From domain. Without alignment, a message may have authentication evidence but still not pass DMARC.
Common authentication problems
- Multiple SPF records for the same domain.
- SPF include chains that exceed DNS lookup limits.
- Missing or incorrect DKIM selector records.
- DMARC set to monitoring but never reviewed.
- Messages sent from services that do not align with the From domain.
Basic troubleshooting workflow
- Check DNS records.Confirm SPF, DKIM and DMARC are published where expected.
- Send a real message.Use message headers to verify actual authentication behavior.
- Review alignment.Check whether the passing identity matches the visible From domain.
- Re-test after changes.DNS updates can take time, so verify again after propagation.