Home Topics Email Authentication
Email Authentication
SPF, DKIM, DMARC, ARC, and MTA-STS: proving your mail is really from you.
- SPF
- DKIM
- DMARC
- ARC
- MTA-STS and TLS-RPT
- DMARC report analysis
- Subdomain delegation for vendors
- Reverse DNS and PTR records
Analyse before you read
All analysersSPF record analyser
Parse an SPF record, count its DNS lookups, and find what will break it.
DMARC record analyser
Grade a DMARC record on enforcement, not just syntax.
DKIM key analyser
Check a DKIM public key's strength, revocation state, and tags.
SPF
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for a domain. Receivers check the connecting IP against that list during the SMTP transaction.
26 more for specific providers, platforms, industries, and regions
DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature header to each message. The public key lives in DNS under a selector, and receivers verify the signature to confirm the message was not altered and was authorized by the signing domain.
26 more for specific providers, platforms, industries, and regions
DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send aggregate and forensic reports back to the domain owner.
26 more for specific providers, platforms, industries, and regions
ARC
ARC preserves authentication results across intermediaries such as mailing lists and forwarders. Each hop signs the results it saw, so the final receiver can trust an earlier pass even if SPF or DKIM broke in transit.
21 more for specific providers, platforms, industries, and regions
MTA-STS and TLS-RPT
MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain declare that inbound mail must be delivered over TLS with a valid certificate. TLS-RPT provides reports on delivery failures caused by TLS problems.
15 more for specific providers, platforms, industries, and regions
DMARC report analysis
DMARC aggregate (RUA) reports are daily XML files sent by mailbox providers listing, per sending IP, how many messages claimed your domain and whether they passed SPF, DKIM, and alignment. Forensic (RUF) reports contain samples of individual failures.
26 more for specific providers, platforms, industries, and regions
Subdomain delegation for vendors
Subdomain delegation gives each third-party sender its own subdomain (for example news.example.com for the ESP, help.example.com for the helpdesk) with dedicated SPF, DKIM, and DMARC records, so each vendor's reputation and configuration are isolated.
26 more for specific providers, platforms, industries, and regions
Reverse DNS and PTR records
A PTR record maps a sending IP address back to a hostname. Mailbox providers check that the PTR resolves and that the hostname's A record points back to the same IP (forward-confirmed reverse DNS).