Email Authentication: What It Is and Why It Matters

Email is an effective marketing channel when messages reach recipients. The challenge is deliverability. Even if your audience is super receptive, you need to convince email platforms to allow your emails through spam filters.

This is where email authentication becomes really important.

While it’s possible to send emails en masse without verifying your identity, your messages are likely to be marked as spam sooner or later. You can prevent this by taking a few key steps in advance.

In this quickstart guide, we’re going to explain what email authentication is all about and explore how to authenticate your email accounts.

What Is Email Authentication?

Email authentication is about verifying your identity as the sender. It's a bit like a background check, except there’s no need to dig out your driver’s license or passport.

In most cases, you can authenticate your email account by updating the DNS records of your domain. This creates a cryptographic identifier that allows email service providers to track who is sending emails.

The advantage of authentication is that senders who misbehave can be traced and blocked. On the flip side, good senders (like you) can build up a positive reputation that shields your messages from spam filters.

There are several different protocols for email authentication in use today. New technical standards have been introduced by various organizations over time, in part as a response to emerging cybersecurity threats.

However, the new additions have never replaced the older standards — mainly because senders want to reach every user, including those using older email clients and standard-specific platforms.

Why Does Email Authentication Matter?

The standout reason to authenticate your email is to protect legitimate emails from ending up in spam folders. Repeatedly landing in spam can lead to a damaged sender reputation, resulting in future emails being automatically filtered into spam. This means a drastic reduction in the visibility and effectiveness of your campaigns.

Email authentication acts not only as a proactive measure to avoid this scenario, but also as a remedial step to recover from a previously tarnished reputation.

The reason is that email providers keep a list of senders, where they share information about who has been “naughty or nice.” Authenticated email accounts with a strong sender reputation tend to avoid the clutches of overzealous spam filters. In contrast, accounts that are unverified are usually the first to suffer the spam folder treatment.

Google is taking a particularly hard-line stance. The search giant recently announced that from February 2024 onwards, senders who send 5,000 or more emails each day to Gmail accounts without being verified are likely to see a significant drop in deliverability.

There are other good reasons to authenticate your email from a business perspective, as well. Email users want to know that they are receiving a message from a legitimate sender before opening your email. Email spoofing is a common problem, and it can quickly derail trust in your brand.

What Is Email Spoofing?

Email spoofing is when an email appears to have originated from one source, when it was really sent by someone else.

To achieve this sleight of hand, the spoofer simply forges the From: field in the email, to display a name and address of their choosing.

At first inspection, this might sound like nothing more serious than digital mischief. But skilled spoofing can be used for nefarious purposes.

At the low end of the scale, spoofers could use your brand to encourage users to open sales emails for unrelated products.

More worryingly, some cyber criminals use spoofing to lure people into giving up private information or money via phishing scams. Google and Facebook lost a combined total of $100 million in a single attack of this type back in 2017.

If you don’t want your name or brand caught up in this type of problem, email authentication is a must.

How Email Authentication Works

Whenever someone sends an email, providers want to check the message. More specifically, they try to confirm:

• The identity of the email sender.
• That the email content has not been altered.

To achieve this, email platforms use various different verification systems. Some check the email server that sent the message, while others examine the digital signature and encryption that were used by the sender.

4 Key Email Authentication Methods

Today, there are four email authentication standards in common usage, and another 5–10 less common or emerging standards that address specific use cases.

You don’t have to use them all. But verifying yourself with all four core standards is highly recommended. Here’s a closer look at each of them:

1. SPF: Sender Policy Framework

Perhaps the most basic form of email authentication is SPF (Sender Policy Framework).

In an attempt to prevent email spoofing, this standard verifies whether incoming mail has been sent from a mail server or IP address that is authorized by the email domain owner. Here’s how it works:

1. Senders publish approved server IP addresses in their domain name DNS records.
2. Receiving email clients then cross-check new emails against these records.
3. Any mismatch indicates potential spoofing.

How to Authenticate Your Mail Server With SPF

SPF authentication is based on text records. They might appear complex, but there is a simple system behind them.

Here is an example SPF record:

v=spf1 include:_spf.mail.com ~all

• v=spf1 shows that this record is working on SPF version 1.
• include:_spf.mail.com defines the mail servers that you want to use.
• ~all tells receiving servers to allow email that fails the SPF test (albeit with a spam flag).

You can create your own SPF record by hand. For every application or platform that sends email on your behalf, add the matching mail server in the include: section. If you want to be more specific, you can also include IP addresses.

To set up your new SPF record:

1. Visit your domain host and create a new TXT record for your domain.
2. Choose @ or a specific subdomain as the host name, and input your SPF code as the value.
3. Click Save.

You will need to update this record every time you use a new platform to send email.

2. DKIM: DomainKeys Identified Mail

DKIM (DomainKeys Identified Mail) is a digital seal of authenticity for email. This standard verifies the identity of the sender, and ensures that the content of the message hasn’t been altered.

It works like this:

1. When you send an email message, a digital signature is placed in the email header code.
2. The receiving mail server then finds a cryptographic key in the DNS records of the sender’s domain.
3. Using this key, the receiving hoster de-encrypts the DKIM signature, and checks that it matches the content and sender of the email.

It’s a fairly simple system, but pretty effective at reducing spoofing and other problems.

How to Set Up DKIM Authentication

To authenticate your email with DKIM, you first need to set up your key. The exact process varies depending on which email platform you use, but it should go something like this:

1. Visit the admin console of your email provider, and locate the DKIM option (often under Authenticate or Authentication).
2. Look for a Generate button. This will create your key.
3. Copy the provided TXT record name (DNS Host name) and TXT record value.
4. Visit your domain host, and add a TXT record in your domain.
5. In the first field, add the TXT record name. In the second, add your TXT record value.
6. Click Save.
7. Revisit the admin console of your email provider, and switch on DKIM via the authentication settings.

Before step #2, you might be asked to choose the DKIM key bit length — essentially, how long your key will be.

The 2048 standard is preferable, because it is more secure. However, some domain hosts only support 1024 characters. Check with your own host, and use 2048 if possible.

3. DMARC: Domain-Based Message Authentication, Reporting & Conformance

After SPF and DKIM have passed judgment, DMARC (Domain-based Message Authentication, Reporting and Conformance) offers guidance on how to manage email messages that fail authentication tests. The trial and the sentencing, in a sense.

1. Senders create a DNS TXT record that lays out a policy, such as rejecting non-authenticated email.
2. If an incoming email fails both SPF and DKIM, the DMARC policy is applied by the receiving service.
3. When this happens, a report is returned to the sender.

How to Authenticate Your Domain With DMARC

Much like SPF, you create DMARC records manually. Here’s an example record:

v=DMARC1; p=none; rua=mailto:dmarcreports@mail.com

• v=DMARC1 shows that this record is working on DMARC version 1.
• p=none defines your policy.
• rua=mailto:dmarcreports@mail.com provides an email address where receiving clients can send DMARC reports.

There are three possible options for your policy:

• p=none means no action. Use this if you’re not sure.
• p=quarantine tells receiving platforms to mark the message as spam or potentially malicious.
• p=reject instructs receiving platforms to block the message.

Bear in mind that you can include more than one email address in your DMARC record, separated by commas. Once you have finished creating your DMARC record, make sure SPF and DKIM are enabled. Then:

1. Create a new DNS TXT record on your domain.
2. Use _DMARC as the host, and your DMARC record as the value.
3. Hit Save.

To verify that the new record is working correctly, you can use a free online DMARC lookup tool.

4. BIMI (Brand Indicators for Message Identification)

Next to messages in your inbox, you may see a tiny logo that represents the sender. BIMI (Brand Indicators for Message Identification) checks that these thumbnail images are authentic. Here’s the system:

1. The sender uploads their brand logo to a web server, and generates DNS records that reference the files.
2. Email authentication verifies the sender's identity.
3. Email services fetch the pre-validated logo images and display them next to messages.

Validating email thumbnails is actually quite important. Many phishing emails combine basic spoofing with fake logos to trick recipients. People are generally too busy to double check.

By verifying your logo with BIMI, you can prevent such scams and give your customers confidence in your emails.

Note that BIMI support is not yet universal. Some email platforms recognize the protocol, and others are considering it.

Google extends BIMI with blue checkmarks next to verified senders through the Verified Mark Certificate (VMC) program. In contrast, Microsoft does not support the BIMI protocol at all.

How to Set Up BIMI Authentication

To benefit from BIMI authentication, your logo currently needs to be registered as a trademark. You also need to have DKIM and SPF configured on your domain.

The last prerequisite is a DMARC record on your From: domain, with a policy set to quarantine or reject.

Then, to set up BIMI authentication:

1. Create a tiny, square SVG version of your logo. It must have a solid background color, and be 32KB or smaller.
2. Upload it to a public web server and grab the URL.
3. Create a new TXT record on your domain. The host should be default._bimi, and the value should follow this format, where the URL points to your SVG file:

v=BIMI1; l=https://yourdomain.com/your-logo.svg

To verify that your BIMI authentication is working, use the free official checker tool.

As an optional extra, you can apply for the Verified Mark Certificate (VMC) program. Once this process is complete, add your official VMC logo to the end of the TXT record like this:

v=BIMI1; l=https://exampledomain.com/your-logo.svg
a=https://exampledomain.com/your-vmc-logo.svg

Gmail will then display a blue checkmark next to your email address whenever users open your messages.

Other Ways to Improve Deliverability

One major benefit of configuring authentication is improved email deliverability. Bypassing spam filters ensures that the majority of your messages will find their target.

That said, authentication isn’t a magic bullet. If you want to maximize deliverability in your next email campaign, take note of the following best practices.

1. Verify Email Addresses in Your List

Most email lists contain plenty of invalid and incorrect addresses. This has a major impact on deliverability, and could even count against your sender reputation. You can fix the problem quite easily using a tool like NeverBounce. Our platform can automatically verify and clean your entire email list, and even validate new sign-ups.

2. Monitor Feedback Loops

When users manually flag a message as junk or spam, that information is passed back to the sender. If you receive this kind of feedback, take note. When too many of your messages are flagged in this manner, email service providers will be more likely to filter any future messages you send.

3. Ensure Accurate Identifier Alignment

Email programs use a variety of identifiers to authenticate incoming emails. When these don’t match, your messages may be marked as inauthentic. To avoid this issue, make sure that your From addresses, SPF records, and DKIM signatures use the same domains and sender addresses.

4. Watch Your Sender Reputation

Everyone who sends email has a reputation score. This metric helps email service providers to track who is sending relevant content, and who is spamming users with unwanted marketing and malicious messages. Senders who fall into the latter category will see reduced deliverability. They may eventually have their accounts suspended.

To avoid this fate, it’s important to monitor your reputation. Sites such as Sender Score and Barracuda Central allow you to look up your current score. If you see it moving in the wrong direction, consider reducing the volume of emails you send or making them more relevant to the email recipients.

5. Control Volume

Whether your reputation is strong or weak, curbing volume is generally a smart move. Huge email campaigns and repeated messages are both considered risk signals by service providers.

Rather than blasting out a flurry of messages, try to maintain a steady cadence. You shouldn’t be dominating the email inbox of your subscribers.

Improve Deliverability Today

Whether you’re just starting out in email marketing or running a huge account, improving deliverability is always a battle.

NeverBounce can help you win the war, with email validation tools that are easy to use and affordable for any business. They even work with your favorite email platform.

Sign up free today to try NeverBounce for yourself and join 125,000 users who are already enjoying better deliverability.