Building a brand that prioritizes security and trust with its customers is a straightforward way to build a loyal client base. Email authentication is the best way to build a trustworthy brand reputation and ensure all your messages are delivered correctly to your clients.
Email security professionals have used DKIM, SPF, and DMARC for decades to build trust with customers and diminish the potential for cyberattacks. This has been widely successful among many brands and agencies for building their reputation.
This guide will take you through the basics of three of the most popular systems for creating secure, trustworthy emails that always get delivered straight to your client’s inbox.
Understanding the Basics of Email Authentication
In 2018, the Department of Homeland Security ordered all agencies to implement email security strategies to ensure their data was protected. This order was followed by similar directives in Australia and the UK. Basic email authentication is becoming more and more essential for brands to be considered secure.
Email authentication works by layering different forms of verification and strategy to ensure that each email is sent from an authorized source. This is done to prevent email spoofing, where a malicious user impersonates a trusted email domain to scam customers. If your email is vulnerable, a cyberattack like this can happen, creating victims and ruining your brand’s reputation.
The protocols used in email authentication include SPF and DKIM which both operate to verify that an email comes from a verified sender. Email authentication also involves DMARC, a strategy that determines what to do with emails that pass or fail DKIM or SPF verifications.
The overlap of these three systems creates a stable and secure lattice that defends your domain and ensures trust in your brand. Learning these protocols is essential to learn email marketing and ensure that every message you send to the client reaches them correctly.
Adoption is uneven, though, which is exactly why these protocols still matter. Across the domains we test, 93% publish a valid SPF record and 90% sign their mail with a working DKIM key, but only 49% publish a DMARC policy, meaning 51% of domains still have no DMARC at all. Getting all three in place puts you ahead of the majority.
Key Email Authentication Techniques
SPF (Sender Policy Framework)
SPF prevents email spoofing by verifying the IP address you are sending your emails from. This prevents the use of attackers from impersonating your domain and scamming your clients. SPF does this by using a whitelist of verified IP addresses and checking this against the address of the sender.
SPF creates more secure emails by utilizing a limited set of authenticated sources to discover insecurities from. It is difficult for a malicious user to add their address to your whitelist or otherwise spoof your email domain.
DKIM (DomainKeys Identified Mail)
DKIM signs each outgoing message with a cryptographic key instead of listing approved servers. The sending platform holds a private key and signs the message, and the receiving server checks that signature against a public key published on your domain.
Because the signature covers the message itself, DKIM also proves the content was not altered between send and delivery, which SPF cannot do. That makes it the harder of the two to forge and the one that survives forwarding.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC is a strategy for email security that builds off of DKIM and SPF protocols. DMARC tells the email server what to do with emails authenticated or by SPF or DKIM, choosing to either send unverified emails to spam or reject sending them altogether. DMARC also helps internet service providers detect false positives in the verification process, improving the security of the overall system.
Although DMARC is not required, it is highly recommended as it provides a framework for how to handle your email security strategy. SPF and DKIM alone cannot automate what to do with each email they reject or verify. Only DMARC can ensure that each insecure email is prevented from reaching your customers. Fortunately, it is easy to set up and usually works well alongside the other email security protocols.
How SPF, DKIM and DMARC fit together
The three protocols answer different questions, and a receiving server checks them in order. SPF asks whether the connecting server was authorised to send for your domain. DKIM asks whether the message was altered in transit and which domain signed it. DMARC asks what the receiver should do when either check fails, and where to send the report.
That order matters when you deploy them. Publish SPF and DKIM first and confirm both pass on real sends, because DMARC only takes effect when at least one of them passes and aligns with the domain in the From header. Then publish DMARC at p=none, read the reports for a few weeks to find the legitimate senders you had forgotten about, and only then move to quarantine and reject.
Record syntax, the DNS steps and the failure modes specific to each protocol are covered in full on the dedicated SPF, DKIM and DMARC pages.
Additional Email Authentication Measures
BIMI (Brand Indicators for Message Identification)
BIMI is an email standard that adds your brand’s logo to emails that you send from your domain. This improves your brand’s visibility and security by creating a recognizable image for your clients to associate your brand with. Unlike DKIM, SPF, and DMARC, BIMI is something that your customers will notice in their inboxes.
Email service providers like Google and Yahoo are actively encouraging their users to implement the BIMI standard by only allowing a brand to use it when they have every other email protocol in place. This means that clients will instantly trust BIMI emails. Adoption is still rare (99% of the domains we test publish no BIMI record at all), so getting one in place is a genuine way to stand out in a crowded inbox.
Monitoring and Troubleshooting Email Authentication
There are dozens of tools out there designed to help you monitor your email security strategy and make changes as necessary. MXalerts and SolarWinds are two examples of software that give you server performance data, email issue troubleshooting, and spam detection to ensure that all of your emails land safely in your customer’s inbox. If you simply want to confirm your policy is published and parsed correctly, you can run your domain through a free DMARC checker before digging into the full reports. Without using any programs, your DMARC reports and your email service provider should give you enough information on their own to monitor your email security.
A few common issues with email security are insecure passwords and using public wi-fi. These are risks that cannot be solved by practices like DKIM, SPF, or DMARC because they are insecurities outside of the email server.
Best Practices for Email Authentication
Cyberattack strategies are constantly innovating and changing to attack well-known systems like DKIM, SPF, and DMARC. This means you have to stay vigilant and constantly maintain your systems through testing to ensure you have the most secure emails possible. Running a periodic email health check across all three protocols at once is the quickest way to catch a record that has drifted out of date before it costs you deliverability. It pays off, too: in our testing only 89% of messages clear a full deliverability check (9% land a warning and 2% fail outright), so regular maintenance is what keeps you in that passing majority.
With DKIM, it is important to regularly rotate your pair keys to ensure that cyber attackers cannot take advantage of stagnant keys. Regular changing means that your system is constantly updating itself and is one step ahead of any malicious attack.
With SPF, it is necessary to regularly check your whitelist to ensure that only your verified senders can utilize your email domain. Additionally, make sure that none of your senders share an IP address with someone untrusted.
You can test both your SPF and DKIM protocols by sending yourself decoy emails. The exact method will vary depending on your email provider. For example, on Google, once you send an email to your decoy account, you can check the details of the opened message. If your security protocols worked, the email should read “mailed-by: your domain” and “signed-by: your domain”.
Within your DMARC strategy, it is recommended to detail your protocols to exactly what your brand needs. For example, not all companies need to reject every single unverifiable email, while for others this is necessary. Make sure you are using the strategy that is right for you, not just the one that seems the most “secure”.
If you want a quick and reliable way to check whether your emails go to spam, use our email spam test tool.
Final Thoughts
For a successful email authentication strategy, it is essential to use all three protocols laid out in this guide: SPF, DKIM, and DMARC. While one protocol may be enough to gain initial trust amongst your customers, it only takes one insecure facet of your emails for a lethal cyberattack that destroys your brand’s entire reputation.
Follow the steps in this guide. You can easily create an email security system that effectively reduces your risk of attack and increases the loyalty of your customers as they increasingly trust your brand.
If you’re still struggling with the best way to implement SPF, DKIM, and DMARC protocols, it may be time to consult an email deliverability consultant.
