Email Authentication Setup Guides

SPF setup

What it does

SPF identifies which sending systems are authorized for a domain.

What you need

Access to DNS for example.com and the exact values supplied by your email provider or sending platform.

Example

v=spf1 include:_spf.example.com ~all

Setup steps

1. List every service that sends mail for example.com.
2. Check whether an SPF record already exists.
3. Merge required mechanisms into one effective SPF record.
4. Publish the TXT record at the domain root.
5. Verify the record and review DNS lookup usage.

Common mistakes

• Publishing multiple SPF records for the same domain.
• Overwriting an existing record without merging providers.
• Using +all or too many DNS-querying mechanisms.

How to verify

Use Mailvovo to check DNS configuration, then send a real message and inspect headers when you need message-level evidence.

DKIM setup

What it does

DKIM signs messages so receivers can verify message-level domain evidence.

What you need

Access to DNS for example.com and the exact values supplied by your email provider or sending platform.

Example

selector._domainkey.example.com TXT public key provided by your email service

Setup steps

1. Enable DKIM in the sending provider or mail platform.
2. Copy the selector name and TXT value from that provider.
3. Publish the selector record in DNS.
4. Send a test message and inspect the DKIM result.
5. Rotate or remove old selectors when a provider recommends it.

Common mistakes

• Changing the selector name supplied by the provider.
• Pasting a truncated key into DNS.
• Assuming DKIM is active before a real signed message is sent.

How to verify

Use Mailvovo to check DNS configuration, then send a real message and inspect headers when you need message-level evidence.

DMARC setup

What it does

DMARC connects SPF and DKIM alignment to a visible domain policy and aggregate reporting.

What you need

Access to DNS for example.com and the exact values supplied by your email provider or sending platform.

Example

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Setup steps

1. Start with a monitoring policy if you need visibility first.
2. Add an aggregate reporting address you can receive and review.
3. Confirm SPF or DKIM aligns with the visible From domain.
4. Review report data before increasing enforcement.
5. Move toward quarantine or reject only after legitimate senders are understood.

Common mistakes

• Treating p=none as protection rather than monitoring.
• Increasing enforcement before identifying all legitimate senders.
• Publishing reporting addresses that cannot receive reports.

How to verify

Use Mailvovo to check DNS configuration, then send a real message and inspect headers when you need message-level evidence.

BIMI setup overview

BIMI can help display a brand logo in supported inboxes, but it depends on strong domain authentication and mailbox-provider support. Before publishing BIMI, verify DMARC alignment and review your provider's logo and certificate requirements.

DNS record verification

DNS changes may take time to propagate. Check the exact hostname, record type, value, and provider-specific formatting. Some DNS dashboards hide quotes or split long TXT values automatically.

Common DNS mistakes

• Publishing a TXT value at the wrong hostname.
• Creating duplicate SPF records instead of one merged record.
• Copying smart quotes or extra spaces into DNS values.
• Testing too soon after DNS changes.
• Assuming one provider's example applies to every sender.