Email Authentication

Email authentication and spam protection — DMARC, SPF and DKIM. Is your email secured with all the correct deliverability policies?

Email protection

DKIM, DMARC and SPF are the three requirements. Check your business email domain and test your setup with these tools:

• dmarcian.com domain checker — check DMARC, SPF and DKIM.
• mail-tester.com — test your email spam score.
• Google Postmaster Tools — sender compliance.

Why it matters

Email authentication settings ensure that your emails get delivered into inboxes and not spam boxes. They also help protect your domain from being used for outbound spam by scammers or spammers. All email addresses that have their own domain name need to be configured and authenticated for SPF, DKIM and DMARC to ensure validated delivery under the 2024 global compliance requirements.

If you wonder why your emails are frequently going to other people's spam boxes, not being delivered, or being marked as a "risk to view" or carrying warning alerts, then you need to get your email authentication set up correctly. A simple configuration reduces the risk of hackers spoofing your email address and ruining your business reputation, which can be difficult to recover from.

Following the requirements will help reduce and block spam, spoofing, fraud and phishing. Never bulk email from your domain name if you want to ensure deliverability in the future — always use a different domain or subdomain to do this. When enough people in a larger receiving group like Gmail tag your emails as spam, you will continue to have deliverability issues.

If you need to get your domain's email secured, then give IT Pro Expert a call and we will gladly assist you with this process.

What each record does

DKIM, SPF and DMARC allow internet mail services to verify that a sender is authorised to send email from your domain. Together they block third parties from sending emails using your domain name and pretending to be you.

Configuring all of these components is a difficult task. It requires complex DNS configuration and testing, and can easily be misconfigured by an inexperienced user, causing email outages or dropped emails.

Setup guide for Microsoft 365 platforms

A guide for IT companies that use Microsoft 365 platforms. Please follow these instructions.

1. Open both consoles

   Open your DNS configuration website — typically wherever the domain name was purchased — and go to DNS configuration. At the same time, open your 365 admin configuration at admin.microsoft.com for the same domain and log in.

2. DKIM

   Start from the 365 admin DKIM page and run the diagnostic test, or go straight to the DKIM configuration at security.microsoft.com/dkimv2. Look at the list of DomainKeys Identified Mail (DKIM) domain names and click the line with the domain you are setting up. A right-hand panel appears with the option to enable.

   If DKIM is already enabled on the 365 admin DKIM page side panel, disable it for five minutes and then re-activate it, otherwise it will fail to give you the right settings. There is no need to rotate keys.

   You will get two new DNS records to enter as CNAME entries, using TTL 3600 if asked. First entry — host selector1._domainkey, value selector1-THISISPROVIDEDBYMICROSOFT01e._domainkey.THISISPROVIDEDBYMICROSOFT.onmicrosoft.com. Second entry — host selector2._domainkey, value selector2-THISISPROVIDEDBYMICROSOFT01e._domainkey.THISISPROVIDEDBYMICROSOFT.onmicrosoft.com.

3. DMARC

   Add the following to your DNS as a TXT record, changing the example email address to one of your own. Host _dmarc, value v=DMARC1; p=reject; pct=100; rua=mailto:email@mydomainname.com; ruf=mailto:email@mydomainname.com; fo=1

   Advanced details on DMARC options: mxtoolbox.com DMARC tags.

4. SPF

   Insert a new TXT record in the DNS: v=spf1 include:spf.protection.outlook.com -all

   If you have multiple email engines, such as HubSpot, do it like this instead — host @, value v=spf1 include:spf.protection.outlook.com include:1234567.spf01.hubspotemail.net ~all

5. Check your work

   Run a check using the dmarcian domain checker and make sure all three of DKIM, DMARC and SPF are working.