Domain Authentication

Why Domain Authentication Matters

When you send emails through SentinMail, recipient mail servers (Gmail, Outlook, Yahoo, etc.) check whether your domain actually authorized the sending server. Without proper authentication, your emails are far more likely to land in spam or be rejected entirely.

Domain authentication does three things:

• Improves deliverability — authenticated emails are trusted by inbox providers and reach the inbox instead of the spam folder
• Prevents spoofing — stops bad actors from sending emails that pretend to come from your domain
• Builds sender reputation — over time, properly authenticated domains earn a positive reputation that further boosts deliverability

There are three DNS records you need to set up: SPF, DKIM, and DMARC. Each one handles a different aspect of authentication. This guide walks you through all three.

SPF (Sender Policy Framework)

SPF tells receiving mail servers which servers are allowed to send email on behalf of your domain. It works by publishing a DNS TXT record that lists your authorized senders.

How SPF Works

When someone receives an email from you@yourdomain.com, their mail server looks up the SPF record for yourdomain.com. If the sending server's IP address is listed in the SPF record, the email passes the SPF check. If not, it fails.

Adding Your SPF Record

SPF Record Examples

If you are starting from scratch and only use one provider:

1v=spf1 include:_spf.google.com ~all

If you use multiple providers, combine them into one record:

1v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net ~all

The ~all at the end means "soft fail" for any server not listed, which is the recommended starting point. Once you are confident your SPF record is complete, you can change it to -all (hard fail) for stricter enforcement.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. The receiving server verifies this signature against a public key published in your DNS. This proves the email was not tampered with in transit and genuinely came from your domain.

How DKIM Works

Your SMTP provider signs each outgoing email with a private key. The corresponding public key is published as a DNS TXT record on your domain. When a recipient's mail server receives the email, it fetches the public key from DNS and verifies the signature.

Setting Up DKIM

1```

DMARC (Domain-based Message Authentication)

DMARC ties SPF and DKIM together and tells receiving mail servers what to do when an email fails authentication. It also lets you receive reports about authentication results so you can monitor your domain's email health.

How DMARC Works

DMARC checks that the domain in the "From" header aligns with the domain that passed SPF or DKIM. Even if SPF and DKIM both pass, DMARC can still fail if the domains do not match. DMARC also defines a policy: should failing emails be delivered, quarantined, or rejected?

Adding Your DMARC Record

1```dns
2v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1;
3```

Provider-Specific Guides

Each email provider has slightly different steps for setting up domain authentication. Select your provider below for specific instructions.

Verifying Your Setup

After adding your DNS records, use these free tools to confirm everything is working:

1```
2SPF:    PASS
3DKIM:   PASS
4DMARC:  PASS
5```

Common Issues and Troubleshooting

Multiple SPF Records

Having more than one SPF TXT record on your domain will cause SPF to fail entirely. If you use multiple sending services, combine them into a single record:

1v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all

DKIM Alignment Failures

DKIM alignment fails when the domain in the DKIM signature (d= tag) does not match the domain in the email's "From" header. This commonly happens when:

• You send from hello@yourdomain.com but your DKIM is signed with your provider's domain instead of yours
• You have not completed the domain authentication process in your provider's dashboard

The fix is to complete domain authentication in your provider's settings so DKIM signs with your domain, not theirs.

SPF Alignment Failures

SPF alignment fails when the MAIL FROM domain (envelope sender) does not match the "From" header domain. This is common with Amazon SES unless you set up a custom MAIL FROM domain. Check the provider-specific guide above for instructions.

DNS Propagation Delays

DNS changes are not instant. If you just added records:

• Wait at least 1-2 hours before testing
• Some DNS providers can take up to 48 hours to propagate
• Use whatsmydns.net to check if your record has propagated globally
• Clear your local DNS cache if you are testing from the same machine

"SPF Record Not Found" After Adding It

Common causes:

• The record was added to the wrong domain or subdomain
• The host/name field contains the full domain (e.g., yourdomain.com) when the provider only expects @ or a blank value
• There is a typo in the record — double-check that it starts with v=spf1

DMARC Reports Show Failures You Do Not Recognize

If your DMARC reports show emails failing from IP addresses you do not recognize, it could be:

• A legitimate service you forgot to include in your SPF record (e.g., a CRM, helpdesk, or marketing tool)
• Someone spoofing your domain (which is exactly what DMARC is designed to catch)

Review the source IPs in the reports and add any legitimate services to your SPF record. Unknown sources can be safely ignored — your DMARC policy will handle them.

Authentication Checklist

Use this checklist to make sure you have covered everything:

• SPF record added — a single TXT record at @ with all sending sources included
• SPF lookup count is under 10 — verified with MXToolbox
• DKIM configured — public key added to DNS with the correct selector, verified in your provider's dashboard
• DMARC record added — TXT record at _dmarc with at least p=none to start
• DMARC reporting email set — rua=mailto: points to a mailbox you monitor
• Test email sent — checked with mail-tester.com and scored 9/10 or higher
• Email headers verified — SPF, DKIM, and DMARC all show PASS in Gmail's "Show original"
• Monitoring scheduled — plan to review DMARC reports weekly and tighten policy to p=quarantine or p=reject within a month