Setting Up Email Authentication for New Domains

Why the Order of Operations Matters

Email authentication protocols build upon each other. Implementing them in the wrong order can cause deliverability issues, rejected emails, or a false sense of security. The correct sequence is:

SPF (Sender Policy Framework)

Authorizes which servers can send email for your domain

DKIM (DomainKeys Identified Mail)

Cryptographically signs your emails to prove authenticity

DMARC (Domain-based Message Authentication)

Ties SPF and DKIM together with a policy for handling failures

DMARC depends on SPF and DKIM being in place first. Setting up DMARC without the other two is like installing a security alarm without any doors or windows to protect.

Complete Setup Checklist

Follow this checklist in order. Each step builds on the previous one.

Phase 1: Pre-Setup Planning

Inventory all email sending sources

List every service that sends email on your behalf: email provider, marketing tools, CRM, transactional email services, support systems, etc.

Gather authentication details from each provider

Collect SPF include statements, DKIM selectors, and CNAME records from each email service you use.

Ensure DNS access

Verify you have access to add and modify DNS records for your domain.

Phase 2: SPF Configuration

Create your SPF record

Combine all your sending sources into a single SPF TXT record.

Host: @
Type: TXT
Value: v=spf1 include:_spf.google.com include:sendgrid.net include:mailchimp.com -all

Publish the SPF record to DNS

Add the TXT record at your domain root (@).

Verify SPF propagation

Wait 5-10 minutes, then use a DNS lookup tool to confirm the record is live.

Test with a real email

Send a test email and check headers to confirm SPF passes.

Phase 3: DKIM Configuration

Generate DKIM keys for each sending service

Each email provider will give you unique DKIM records to add.

Add DKIM records to DNS

Typically CNAME or TXT records at selector._domainkey.yourdomain.com.

Host: selector1._domainkey
Type: CNAME
Value: selector1-yourdomain-com._domainkey.your-provider.com

Enable DKIM signing in each service

After adding DNS records, activate DKIM in your email provider's settings.

Verify DKIM is signing emails

Send test emails and check for DKIM-Signature headers and DKIM=pass results.

Phase 4: DMARC Configuration

Start with a monitoring-only policy (p=none)

This lets you collect data without affecting email delivery.

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com

Set up a mailbox or service for DMARC reports

Consider using a DMARC reporting service to parse and visualize reports.

Monitor reports for 2-4 weeks

Review reports to identify any legitimate sending sources you missed.

Gradually strengthen the policy

Move from p=none to p=quarantine, then finally to p=reject.

Common Mistakes to Avoid

Multiple SPF records

Your domain can only have ONE SPF record. Multiple records cause SPF to fail. Combine all sources into a single record using multiple include statements.

Exceeding SPF DNS lookup limit

SPF allows a maximum of 10 DNS lookups. Each "include" and "a" mechanism counts as a lookup. Use an SPF flattening service if you hit this limit.

Using ~all instead of -all in SPF

Soft fail (~all) provides weaker protection. Once you've verified your sending sources, use hard fail (-all) for better security.

Starting DMARC with p=reject

Going straight to reject can block legitimate emails from sources you forgot to authorize. Always start with p=none and monitor first.

Forgetting third-party senders

CRM systems, helpdesk software, marketing tools, invoicing systems - all need to be included in your SPF and set up with DKIM.

Not testing after DNS changes

Always send test emails and verify authentication passes in email headers after making any DNS changes.

Testing Your Setup

After configuring each protocol, verify it's working correctly:

Check Email Headers

Send a test email to yourself (Gmail works well for this) and view the original message headers. Look for:

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of sender@yourdomain.com designates...)
       dkim=pass header.d=yourdomain.com
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=yourdomain.com

Use Online Validation Tools

Domain Scanner

Use our domain scanner to check all your DNS records at once.

Send test emails to mail-tester.com

Get a detailed report on your email authentication and deliverability.

Test from each sending service

Send test emails from every service that sends on your behalf to verify each one passes authentication.

Timeline for Reputation Building

Email authentication is just the foundation. Building sender reputation takes time and consistent good practices.

Week 1-2: Setup Phase

Configure SPF, DKIM, and DMARC (p=none). Verify all records are correct. Begin collecting DMARC reports.

Week 2-4: Monitoring Phase

Review DMARC reports. Fix any authentication failures. Add any missing sending sources. Start warming up your domain with low email volumes.

Week 4-8: Strengthening Phase

Move DMARC to p=quarantine. Continue monitoring. Gradually increase email volume. Watch bounce rates and spam complaints.

Month 2-3: Enforcement Phase

Move DMARC to p=reject. Your domain is now fully protected. Continue monitoring for any issues.

Month 3-6: Reputation Building

Maintain consistent sending patterns. Keep spam complaints under 0.1%. Consider adding BIMI once you have p=quarantine or p=reject. Your sender reputation will improve over time with good practices.

Summary

1.Inventory all your email sending sources before you start
2.Configure SPF first - one record, all sources, use -all
3.Set up DKIM for each sending service
4.Deploy DMARC starting with p=none, then gradually enforce
5.Test thoroughly after each change
6.Allow 2-3 months to reach full DMARC enforcement
7.Building strong sender reputation takes 3-6 months of consistent good practices

Next Steps

Once you have SPF, DKIM, and DMARC working with p=quarantine or p=reject, consider these advanced configurations:

Set up BIMI to display your logo in inboxes Learn about MTA-STS for encrypted email transport