What is Email Authentication? Check and Authenticate Your Emails

What are the 3 Major Email Authentication Protocols?

While there are several email authentication methods, three of these form the foundational elements of authentication. They are SPF, DKIM and DMARC. 

1. SPF (Sender Policy Framework)

SPF authenticates your emails by helping you publish an authorized list of senders. So if “1.12.1.11” is a legitimate sender IP for your emails, you can add it to your SPF record. This will help receiving servers recognize emails received from this IP and your domain, as legitimate. Subsequently, an email sent from an IP address that is outside the scope of your SPF record, will be recognized as suspicious. 

SPF Email Authentication Process 

A domain owner publishes an SPF record in their DNS that contains IP addresses for all authorized email senders. This enables the SPF protocol. The recipient’s email server looks up this SPF record to confirm whether the mail server is authorized for the sending domain. If it is authorized, SPF passes, else it fails for that message. 

2. DKIM (DomainKeys Identified Mail)

DKIM uses digital signatures (cryptography) to sign emails and ensure that it remains unaltered throughout the delivery process. DKIM can help prevent man-in-the-middle attacks where an attacker intercepts email communications to alter message content. It is also helpful in verifying legitimate messages in email forwarding scenarios, where SPF fails. 

DKIM Email Authentication Process

2 DKIM key pairs are generated by the domain owner during DKIM implementation. The public key is published on the DNS, and the private key should only be shared with the ESP who is responsible for signing outgoing emails. Once you send an email from your domain, your signer uses the private key to create a cryptic value for your message body that gets appended to your message header. This signature can then be verified by the receiving server by matching it against your public key. A match suggests DKIM pass for your email. 

3. DMARC (Domain-based Message Authentication Reporting & Conformance)

DMARC is an email authentication protocol that helps domain owners control how they want unauthorized messages to be treated. With DMARC you can take strict action (if you wish) against messages that fail SPF or DKIM authentication checks. To configure DMARC you need to implement either SPF or DKIM. If you configure both, for your emails to pass DMARC, it should pass either of the two protocol checks. 

DMARC Email Authentication Process

Your DMARC policy determines how messages that fail SPF or DKIM will be treated. If you configure a policy of “none” no action will be taken. If you configure the “quarantine” policy, your email will be lodged in the recipient’s quarantine folder. If you choose “reject”, emails failing authentication will be discarded. 

Expert Tip: While starting, start with a “none” policy. Then slowly shift to “reject” once you are confident with your setup. For a smoother, risk-free transition, try our hosted DMARC. Only a policy of “reject” is effective against cyberattacks. 

Additional Email Authentication Methods

In addition to SPF, DKIM, and DMARC email authentication methods, there are a few additional protocols that can benefit you: 

1. BIMI (Brand Indicators for Message Identification): BIMI allows brands to display their logo in recipient inboxes. It serves as a visual verification of trustworthiness and provides a professional look to your emails. 
2. MTA-STS (Mail Transfer Agent Strict Transport Security): MTA-STS helps make TLS encryption mandatory in SMTP email communications. This prevents man-in-the-middle attacks like TLS downgrades and DNS spoofing.
3. TLS-RPT (Transport Layer Security Reports): TLS-RPT helps you receive reports providing visibility on email delivery issues due to failures in TLS encryption.