Why email authentication matters

Anyone can write any sender address on an email, much like anyone can write any return address on a letter. Receiving servers such as Gmail and Outlook therefore check whether a message really comes from the domain it claims. SPF, DKIM and DMARC are the three standard checks. Email that fails them is more likely to land in spam or be rejected, and without them anyone could send email in the name of your domain.

What SPF is

SPF (Sender Policy Framework) is a TXT record in the DNS of a domain that lists which servers are allowed to send email for that domain. The receiving server looks up the record and checks whether the server that delivered the message is on the list.

Two rules matter in practice. A domain can only have one SPF record, so new senders must be added to the existing record rather than in a new one. And an SPF record can trigger at most 10 DNS lookups, so a record with too many services in it stops working.

With SendGrid you usually do not need to change the SPF record on your main domain. When you authenticate your domain with automated security turned on, SendGrid uses a CNAME record for a subdomain, and SPF is handled there.

What DKIM is

DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. The sending service signs the message with a private key, and the matching public key is published in your DNS. The receiving server uses the public key to check that the message was sent with permission from your domain and was not changed on the way.

In SendGrid, DKIM is set up with two CNAME records, usually named s1._domainkey and s2._domainkey, when you authenticate your domain. See Authenticate your domain in SendGrid.

What DMARC is

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record named _dmarc in the DNS of your domain. It tells receiving servers what to do with email that claims to come from your domain but fails SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the domain they check matches the domain in the From address. This match is called alignment.

The policy in the record has three levels:

• p=none: deliver the email as normal and only report. This is the usual starting point.
• p=quarantine: put failing email in the spam folder.
• p=reject: refuse failing email.

A simple starting record is a TXT record named _dmarc with the value v=DMARC1; p=none;. You can add an address for reports with rua=mailto:you@yourdomain.com. When the reports show that all your legitimate email passes, you can move to a stricter policy.

What Gmail, Yahoo and Microsoft require

Gmail requires every sender to pass SPF or DKIM. Gmail, Yahoo and Microsoft (Outlook.com and Hotmail) require senders of high volumes to have SPF, DKIM and DMARC, with the From domain aligned. Email that does not meet the requirements can be sent to spam or rejected. A DMARC record with p=none is enough to meet the DMARC requirement.

What you set up for LeadJabber

LeadJabber sends through your own SendGrid or Mailgun account, so authentication is set up there, not in LeadJabber:

• SPF and DKIM: added when you authenticate your domain in SendGrid or Mailgun. Add the DNS records exactly as shown and verify them.
• DMARC: add it yourself at your DNS provider if your domain does not already have one. Check first, because a domain can only have one DMARC record.

Once SendGrid has verified your domain, your email is signed with DKIM for your own domain, so it passes DMARC.

Check your records

You can look up any record with a free online DNS lookup tool. Look up TXT for yourdomain.com to see SPF, TXT for _dmarc.yourdomain.com to see DMARC, and CNAME for s1._domainkey.yourdomain.com to see the SendGrid DKIM record. If DKIM verification fails in SendGrid, see DKIM verification fails in SendGrid.