Your domain is where brand trust begins. Start domain scan
Free trialSchedule a demo

Email authentication guides

Step-by-step fixes and setup guides for SPF, DKIM, DMARC, BIMI and MTA-STS — with copy-paste commands and the free checker for each.

Fixes

How to fix “No DMARC record found” → “No DMARC record found” means your domain can be spoofed. Here is exactly what to publish, where, and how to verify it — in minutes. How to fix SPF PermError — “too many DNS lookups” → SPF allows a maximum of 10 DNS lookups. Exceed it and SPF returns PermError and fails. Here is how to count, consolidate, and flatten safely. SPF softfail (~all): what it means and how to fix it → A ~all (softfail) SPF record accepts unauthorized mail but marks it. Learn when to use ~all vs -all and how to move to hard fail safely. Why DKIM fails and how to fix it → DKIM fails from a missing selector, a revoked key, body modification, or alignment issues. Here is how to diagnose and fix each cause. Can a domain have two SPF records? → A domain must have exactly one SPF record. Two SPF records cause PermError and break authentication. Here is how to merge them correctly. Why does my mail fail DMARC (and how to fix it) → Mail fails DMARC when neither SPF nor DKIM passes AND aligns with the From domain. Here is how to diagnose alignment and fix each sender. Why am I not receiving DMARC reports? → No DMARC aggregate reports arriving? Check your rua address, cross-domain authorization, mailbox capacity and timing. How to move from p=quarantine to p=reject → Ready to enforce DMARC fully? Here’s how to move from p=quarantine to p=reject without blocking legitimate email. Why isn’t my MTA-STS policy working? → MTA-STS needs a TXT record, a policy file over HTTPS, and a valid certificate. Here’s how to fix each failure point. Why isn’t my BIMI logo showing? → BIMI logos need DMARC at enforcement, a square SVG Tiny PS, and usually a VMC. Here’s the checklist to make your logo appear. How to fix “No SPF record found” → “No SPF record found” means receivers can’t verify who may send for your domain. Publish a single SPF TXT record — here’s exactly what and where. DKIM key too long for DNS? Split the TXT record → A 2048-bit DKIM public key can exceed the 255-character TXT string limit. Learn how to split it into chunks so DNS accepts it.

Setup guides

How to set up DMARC for Google Workspace → Set up SPF, DKIM and DMARC for Google Workspace the right way: exact records, the DKIM selector, and the safe path to enforcement. How to set up DMARC for Microsoft 365 → Configure SPF, DKIM and DMARC for Microsoft 365: the exact SPF include, enabling DKIM with selector1/selector2, and reaching enforcement safely. How to add an SPF record in GoDaddy → Add or edit an SPF TXT record in GoDaddy DNS step by step, avoid the common two-records mistake, and verify it resolves. How to set up DKIM for Google Workspace → Turn on DKIM for Google Workspace: generate the 2048-bit key, publish the google._domainkey TXT record, and start authentication. How to set up SPF and DKIM for SendGrid → Authenticate SendGrid email with the correct SPF include and SendGrid’s DKIM CNAMEs, and keep it aligned with DMARC. How to set up SPF and DKIM for Amazon SES → Configure Amazon SES authentication: Easy DKIM CNAMEs, a custom MAIL FROM for aligned SPF, and DMARC alignment. How to authenticate Mailchimp email → Set up Mailchimp email authentication with a verified sending domain and DKIM CNAME so campaigns pass SPF, DKIM and DMARC. How to authenticate Klaviyo email → Configure a Klaviyo dedicated sending domain with the required CNAMEs so your email passes SPF, DKIM and DMARC alignment. How to add a DMARC record in Cloudflare DNS → Add SPF, DKIM and DMARC TXT records in Cloudflare DNS step by step, and use Cloudflare’s DMARC Management if you prefer. How to enable DKIM for Microsoft 365 → Enable DKIM in Microsoft 365 with the two selector CNAMEs, then turn signing on in the Defender portal so mail aligns with DMARC. How to set up DKIM for Zoho Mail → Enable DKIM in Zoho Mail: generate a selector, publish the TXT record, and verify so your mail aligns with DMARC. How to authenticate HubSpot email → Connect and verify a HubSpot email sending domain with the required DKIM/SPF DNS records so your marketing email passes DMARC. How to set up DMARC for a Shopify store → Authenticate Shopify store email: connect your sending domain, publish the DNS records, and add DMARC so order and marketing emails reach the inbox. How to set up SPF and DKIM for Mailgun → Authenticate Mailgun with a verified sending domain: publish the SPF TXT and DKIM record so transactional email passes DMARC alignment. How to add a DMARC record in GoDaddy DNS → Add a DMARC TXT record in GoDaddy DNS step by step, starting in monitoring mode and moving to enforcement safely. How to set up SPF for Zoho Mail → Authorize Zoho Mail to send for your domain with the correct SPF include, and keep it aligned with DMARC. How to authenticate Salesforce email → Set up SPF and DKIM for Salesforce sending so Marketing Cloud and Sales emails align with your domain and pass DMARC.

Explainers

SPF vs DKIM vs DMARC — what’s the difference? → SPF authorizes senders, DKIM signs messages, DMARC ties them to your From domain and sets a policy. Here is how the three work together. DMARC policy: none vs quarantine vs reject → The DMARC p tag has three values. Only quarantine and reject protect you. Here is what each does and how to move between them safely. SPF: ~all vs -all vs ?all vs +all → The “all” mechanism decides what happens to unlisted senders. Here is what ~all, -all, ?all and +all mean and which you should use. What is a DKIM selector? → A DKIM selector points to the public key for a specific signing service. Here is what it is, why it exists, and how to find yours. Does DMARC stop phishing? → DMARC stops exact-domain spoofing once enforced — but not look-alike domains. Here is precisely what it protects against and what to pair it with. DMARC subdomain policy (the sp= tag) → The sp= tag sets a separate DMARC policy for subdomains. Learn how inheritance works and how to protect unused subdomains. How to read a DMARC aggregate report → DMARC aggregate reports are XML. Learn what the key fields mean, how to spot unauthenticated senders, and what to fix. VMC for BIMI: requirements and cost → A Verified Mark Certificate proves you own your logo’s trademark so it shows in Gmail and Apple Mail. Here’s what it needs and costs. Why email forwarding breaks SPF → Forwarding changes the sending server, breaking SPF. Learn why DKIM survives forwarding and how to keep DMARC passing. What is DMARC alignment? → DMARC alignment means the SPF/DKIM-validated domain matches your From domain. Learn relaxed vs strict alignment and why passes still fail DMARC. What is ARC in email authentication? → ARC preserves email authentication results across forwarders and mailing lists so legitimate forwarded mail still passes DMARC. Here’s how it works. SPF flattening explained → SPF flattening replaces include mechanisms with raw IPs to beat the 10-lookup limit. Learn how it works, the risks, and safer alternatives. DMARC rua vs ruf reports → The rua tag collects daily aggregate reports; ruf collects forensic/failure reports. Learn the difference and which one you actually need. Is DMARC required? → DMARC is effectively required: Gmail/Yahoo mandate it for bulk senders, and PCI DSS, NIS2 and others expect anti-phishing controls. Here’s who must comply. Can DMARC improve deliverability? → DMARC improves deliverability indirectly — through authentication, a cleaner sending reputation, and eligibility for BIMI. Here’s how it actually helps. What a good DMARC record looks like → A strong DMARC record enforces policy, collects reports and controls subdomains. Here’s a recommended record and what each tag does. What is DANE for email? → DANE uses DNSSEC and TLSA records to force encrypted, authenticated SMTP delivery. Learn how it compares to MTA-STS and when to use each. BIMI logo requirements (SVG Tiny PS) → BIMI logos must be SVG Tiny Portable/Secure, square, and hosted over HTTPS. Here are the exact logo requirements and common mistakes.

Enterprise

DMARC for enterprise: enforcement at scale → How large organizations roll out DMARC across many domains and senders, reach p=reject safely, and keep it enforced — without blocking legitimate mail. Multi-domain DMARC management → Managing DMARC across many domains: inventory, parked-domain protection, centralized reporting and staged enforcement across the whole estate. DMARC for MSPs and MSSPs → How managed service providers deliver DMARC at scale across many client domains with multi-tenant management, white-label reporting and recurring margin. Google & Yahoo sender requirements checklist → What Gmail and Yahoo require from bulk senders — SPF, DKIM, DMARC, one-click unsubscribe and low spam rates — and how to comply. DMARC and PCI DSS 4.0 email requirements → PCI DSS 4.0 requires anti-phishing controls including DMARC. Here’s what requirement 5.4.1 means and how to document compliance. DMARC for HIPAA email security → How DMARC supports HIPAA email security by preventing spoofing of healthcare domains and protecting patient communications from phishing.