- Help & API
Understanding Email Authentication
Email authentication is an approach to proving that an email is not forged. In other words, it provides a way to verify that an email comes from who it claims to be from. Email authentication is most often used to block harmful or fraudulent uses of email such as phishing and spam.
In practice, we use the term “email authentication” to refer to technical standards that make this verification possible. The most commonly used email authentication standards are SPF, DKIM, and DMARC. These standards were designed to supplement SMTP, the basic protocol used to send email, because SMTP does not itself include any authentication mechanisms.
How does email authentication work?
There are several different approaches to email authentication, each with its own advantages and disadvantages. Although the specific technical implementation varies from approach to approach, in general, the process works something like this:
- A business or organization that sends email establishes a policy that defines the rules by which email from its domain name can be authenticated.
- The email sender configures its mail servers and other technical infrastructure to implement and publish these rules.
- A mail server that receives email authenticates the messages it receives by checking details about an incoming email message against the rules defined by the domain owner.
- The receiving mail server acts upon the results of this authentication to deliver, flag, or even reject the message.
As these steps make clear, in order for this process to work, the sender and the receiver both must participate. That’s why technical standards for email authentication are so important: they define a common approach to defining the rules for email authentication that any organization can implement.
What are the SPF, DKIM, and DMARC email authentication standards?
SPF, DKIM, and DMARC are all standards that enable different aspects of email authentication. They address complementary issues.
- SPF allows senders to define which IP addresses are allowed to send mail for a particular domain.
- DKIM provides an encryption key and digital signature that verifies that an email message was not faked or altered.
- DMARC unifies the SPF and DKIM authentication mechanisms into a common framework and allows domain owners to declare how they would like email from that domain to be handled if it fails an authorization test.
Do I need email authentication?
If you are a business sending commercial or transactional email, you definitely need to implement one or more forms of email authentication to verify that an email is actually from you or your business. Think of it like a digital identification card: it protects your brand, identity, and reputation. Properly configuring email authentication standards like SPF, DKIM, and DMARC is one of the most important steps you can take to improve your deliverability.
Why is this? Without mechanisms for email authentication, email spammers can change the source address of emails at will and try to sneak through spam filters and other defenses. Phishing scams work much the same way, with the sender address changed to appear as if the message had originated from a legitimate sender. Cybercriminals frequently copy the brand look and feel of banks, social networks, and other well-known entities to entice recipients into clicking through to fraudulent websites where user information like passwords or account numbers can be stolen.
But properly configuring your domain for email authentication helps to ensure that your domain cannot be forged, and those measures make it more likely that the IP addresses and sending domains for your email will be trusted by receiving mail servers. In other words, email authentication improves your sender reputation, which could help you to be successful getting your email into the inbox. It also protects your brand and domain reputation from spammers and spoofers. That’s a win-win for you and for your recipients.
Does SparkPost support email authentication?
Yes. SparkPost strongly supports measures that ensure the security, integrity, and deliverability of email. SparkPost implements and adheres to email authentication standards including DMARC, DKIM, and SPF. In fact, all email we deliver for our users is required to be authenticated using standards like these. Configuring DKIM and SPF is a key part of verifying sending domains when you set up a new SparkPost account.
Learn More about Email Authentication
Read more about email authentication best practices
Learn more about email authentication with these resources from SparkPost’s email experts and elsewhere on the web.
- It’s Time for Email Authentication. Our industry experts explain why standards like DKIM, SPF, and DMARC are key to improving digital messaging security and deliverability.
- Understanding SPF and DKIM In Sixth Grade English. An easy-to-understand explanation of how SPF and DKIM work together to ensure email is authenticated.
- MAAWG Sender Best Common Practices. The Messaging Anti-Abuse Working Group, an industry coalition, says email authentication standards are an important best practice for email senders to increase transparency and to reduce incidents of spoofing and forgery.
Get help with email authentication in the SparkPost Support Center
Learn more about how to configure and use email authentication with the SparkPost service in the SparkPost Support Center.
- Setting up DKIM with Domain Providers. How-to’s for configuring records that support email authentication at various DNS hosting providers.
- Why do we need to configure DKIM to send anything? A great explanation of why SparkPost requires that all the email we deliver be authenticated with standards like SPF or DKIM.
More Essential Email Resources
Develop your email industry expertise and master best practices with SparkPost’s email resources.
The Big Rewards of Email Deliverability
Learn how third-party data shows the deliverability difference between SparkPost and also-ran cloud service providers yields hard, bottom-line benefits.read more