Email Authentication — Set Up SPF, DKIM and DMARC in Minutes

What is email authentication?

Email authentication proves to the receiving server that a message really comes from your domain. Without it, anyone can put your domain in the “From” line, and Gmail cannot tell your real email from a fake one.

Authentication uses three DNS records: SPF, DKIM and DMARC. Each record answers a different question. Together they protect your domain from spoofing, and they help your real email reach the inbox.

SPF, DKIM and DMARC: what each record does

SPF is a list of the servers that can send for your domain. When a message arrives, the receiving server checks whether the sending server is on that list.

DKIM adds a digital signature to each message. The receiving server uses the public key in your DNS to check the signature. If someone changes the message on the way, the check fails.

DMARC connects the two. It checks that the domain in your “From” line matches the domain that passed SPF or DKIM. This match is called alignment. DMARC also tells receivers what to do with mail that fails: deliver it (p=none), send it to spam (p=quarantine) or block it (p=reject).

The wizard writes all three records for you, so you never have to get the syntax right by hand.

Why Gmail and Outlook now require SPF, DKIM and DMARC

Authentication is no longer optional for most senders.

Gmail. Every sender to Gmail must authenticate with SPF or DKIM. If you send more than 5,000 messages a day, you also need DMARC on your sending domain, and your “From” domain must align with SPF or DKIM. A policy of p=none meets the requirement.

Outlook.com. Since May 5, 2025, Microsoft has required domains that send more than 5,000 emails a day to Outlook.com addresses to comply fully with SPF, DKIM and DMARC. Mail from these senders that fails goes to the junk folder. If the problem continues, Microsoft can reject the mail with the error 550 5.7.515. The DMARC record must be at least p=none and must align with SPF or DKIM.

Yahoo applies similar rules to bulk senders.

The result is the same everywhere: mail without authentication now goes to spam or does not arrive. For the full checklist, read our Gmail and Yahoo sender requirements guide.

How the neuMails authentication wizard works

• Add your sending domain to your neuMails account.
• Copy the records. The wizard generates the exact SPF, DKIM, DMARC and return-path records for your domain. You do not have to write any syntax.
• Paste them into your DNS provider.
• Watch the check. The wizard checks propagation in real time and shows you which records are live.
• Send. Our team checks your records before your first send.

The setup takes less than 5 minutes. DNS changes can take longer to spread across the internet, and the wizard shows you when they are complete.

What happens after setup

Authentication is not something you set up once and forget. Records break when someone edits DNS, adds a new sending tool or changes provider.

• DKIM key rotation is automatic. neuMails replaces your signing keys on a schedule, so you do not have to.
• Alignment is monitored all the time. If a change breaks alignment, you see it.
• Failures show up in your logs. When a receiving server rejects mail because of a DMARC failure, its response text says so in your email logs.
• Inbox placement is testable. A deliverability test shows whether authenticated mail reaches the inbox or goes to spam.

From p=none to p=reject

p=none meets the Gmail and Outlook requirements, but it does not stop spoofing. It only watches. To protect your domain, you must move to p=quarantine and then to p=reject.

Do not move too fast. If you go to p=reject before every legitimate sender is authenticated, you block your own email. Your CRM, your helpdesk and your payroll tool may all send as your domain.

DMARC reports show you every server that sends as your domain. Our sister product, GoDMARC, turns those reports into a clear path to enforcement, so your domain is protected while your volume grows.

Five common authentication mistakes

• Two SPF records. A domain must have only one SPF record. If it has two, both fail.
• Too many SPF lookups. RFC 7208 limits SPF to 10 DNS lookups. If you add too many include: entries, SPF fails for every message.
• A missing DKIM selector. The key must be at the exact selector that your sending service uses.
• No alignment with third-party senders. A tool that sends as your domain but signs with its own domain passes DKIM and still fails DMARC.
• Moving to p=reject too early. Read your DMARC reports first.

The wizard checks your records for these problems before you send.

Frequently asked questions

What are SPF, DKIM and DMARC?

They are three DNS records that authenticate your email. SPF lists the servers that can send for your domain. DKIM signs each message. DMARC checks alignment and tells receivers what to do with mail that fails.

Do I need all three?

Yes, if you send more than 5,000 emails a day to Gmail or Outlook.com. For smaller senders, all three are still the best practice, and they protect your domain from spoofing.

Is p=none enough?

It meets the Gmail and Outlook requirements. But it only monitors, and it does not block spoofed mail. Move to p=quarantine and then p=reject when your reports show that all your senders pass.

What is DMARC alignment?

Alignment means the domain in your “From” line matches the domain that passed SPF or DKIM. A message can pass SPF and still fail DMARC if the domains do not match.

Does neuMails charge for email authentication?

No. SPF, DKIM and DMARC setup is included on every plan at no extra cost.

How long does setup take?

The wizard takes less than 5 minutes. DNS propagation can take longer, and the wizard shows you when your records are live.

Can I use neuMails with GoDMARC?

Yes. neuMails handles your sending, and GoDMARC handles DMARC reporting and enforcement.