Email authentication, explained
What each record is, how it actually works, and the mistake that catches everyone, in plain English, with a checker on every page so you can see it on your own domain. Start with the one you searched for, or read SenderCheck’s overview of all three.
- What is an SPF record?
- SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email using your domain. When a message arrives, the receiving server reads the domain in the envelope sender, looks up its SPF record, and checks whether the server that actually sent the message is on the list. If it is, SPF passes; if not, the record's policy tells the receiver how suspicious to be. SPF is one of the three checks (with DKIM and DMARC) that decide whether your mail is trusted.
- What is DKIM?
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send, letting a receiver verify the message really came from your domain and was not altered in transit. You publish a public key in DNS; your mail server signs outgoing mail with the matching private key; the receiver fetches the public key and checks the signature. Unlike SPF, a DKIM signature travels with the message, so it still verifies after the mail is forwarded, which is why DKIM is usually what keeps DMARC passing for forwarded mail.
- What is DMARC?
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is the record that ties SPF and DKIM to the From: address a person actually sees, and tells receivers what to do when a message fails. It is the only one of the three that protects the visible sender, and the only one that can instruct a receiver to quarantine or reject forged mail. Google, Yahoo and Microsoft now require it for bulk senders, so for many domains publishing DMARC is no longer optional.
- SPF, DKIM and DMARC explained
- SPF, DKIM and DMARC are three DNS records that together prove your email is really from you. SPF lists which servers may send as your domain. DKIM cryptographically signs each message so it can be verified and shown to be unaltered. DMARC ties those two to the address recipients actually see and tells receivers what to do with mail that fails. You need all three: SPF and DKIM each authenticate something, and DMARC is what turns that into protection for your visible sender.
- What is MTA-STS?
- MTA-STS (Mail Transfer Agent Strict Transport Security) tells other mail servers that they must use encryption when delivering mail to your domain, and refuses delivery if they cannot. Normally server-to-server encryption is optional and can be silently stripped by a network attacker, downgrading the connection to plaintext without anyone noticing. MTA-STS closes that gap by publishing, over HTTPS, a policy that says encryption is required and lists which mail servers are legitimate.
- What is BIMI?
- BIMI (Brand Indicators for Message Identification) is the standard that displays your logo next to your messages in supporting mailbox providers. It is a reward for enforced authentication, not a setting on its own: BIMI only works once your domain has DMARC at quarantine or reject, and some providers additionally require a Verified Mark Certificate proving you own the trademark on the logo. A BIMI record on a domain that is not yet enforcing DMARC has no effect.
- Why are my emails going to spam?
- Most business email lands in spam for one of two reasons: the receiving service cannot confirm the email really came from your domain, or your domain has earned a poor reputation. The first is a settings problem you can fix in an afternoon. Gmail and Outlook check three public settings on your domain before trusting a message: a list of approved senders (SPF), a digital seal (DKIM) and instructions for fake email (DMARC). If any is missing or wrong, invoices, quotes and replies go to spam no matter how good the email is. Check your domain below to see which it is.
- Emails bouncing with 550 5.7.15 from Outlook or Hotmail
- 550 5.7.15 is the code Microsoft returns when it refuses an email because the sending domain does not meet its authentication requirements. Since May 2025, mail to Outlook.com, Hotmail and Live addresses from domains without SPF, DKIM and a DMARC record is rejected rather than filtered, and the bounce message quotes this code. It is a settings problem on your domain, not a problem with the recipient. Check your domain below to see which of the three is missing.