How email authentication actually works

One page per question people arrive with, answered with the mechanism behind it: the records, what a receiver computes from them, and the failure modes that cost you delivery.

My email goes to spam

Mail filed as spam is almost always an authentication failure: no aligned SPF or DKIM pass, and no DMARC record on the From domain.

My email is not arriving

Mail that vanishes without a bounce usually fails at one of four points: MX, SPF permerror, DMARC enforcement, or an expired delegation.

Someone is sending email in my company's name

Anyone can put your domain in the From header. Only a DMARC policy at p=quarantine or p=reject makes a receiver refuse it.

What is SPF?

SPF is one TXT record listing which hosts may send for your domain. The rules that break it: ten lookups, one record, and the all qualifier.

Too many lookups in your SPF record

Above ten DNS lookups an SPF record returns permerror, and receivers treat that as a fail. How the count works and how to get back under it.

What is DKIM?

DKIM signs outgoing mail with a private key and publishes the public key at selector._domainkey. What a receiver verifies, and what it does not.

What is DMARC?

DMARC ties SPF and DKIM to the visible From header and tells receivers what to do when neither aligns. p=none tells them to do nothing.

Your domain name expires

On expiry the registry withdraws the delegation: NS, MX and A leave the parent zone, and mail stops at the same moment as the website.

The 2024 rules of Google and Microsoft

Since February 2024 Gmail and Outlook require SPF, DKIM and a DMARC record, with one-click unsubscribe and a spam rate under 0.3% for bulk.

What is an MX record?

MX records name the hosts that accept mail for your domain, in priority order. The rules: no CNAME, an address record required, and null MX.

Moving nameservers without losing mail

Copy every record before you switch, not just the website. The order that keeps mail up, and why the parent zone decides when it takes effect.

My email goes to spam at Gmail or Outlook

Gmail and Outlook enforce DMARC alignment where smaller providers deliver anyway. Why the same message lands differently at different receivers.