InformationBodyThis article explains the different types of email authentication and their impact on email deliverability. As of February 2024, Google and Yahoo have increased their enforcement of domain authentication. To avoid issues with email delivery, it’s crucial to complete DKIM, DMARC, and SPF authentication for the domain you use to send emails. In This Article Video Tutorial What Is Email Authentication? Important Email Authentication Terms DKIM DMARC SPF Allowlisting Additional Resources Watch a Video Tutorial on Email Authentication Setup What Is Email Authentication? Just like a unique digital signature, email authentication helps prove your sender identity so that your emails are more likely to reach the inbox. Authentication also helps identify forged or fake emails so that they get rejected as spam, which is why many major inbox providers now require it for anyone sending through an email service provider (ESP), such as Emma. There are several types or "protocols" of email authentication senders can use to verify their emails, which are described below. ☑TipWhile essential, authentication alone can’t guarantee that your emails will always land in the inbox. Senders still need to follow deliverability best practices and anti-spam requirements. Important Email Authentication Terms Before we dive into the world of email authentication, it's important to understand some common terms and concepts. Email Delivery is whether the email gets accepted (delivered) or rejected (bounced) by the receiving mail server.Email Deliverability is where the email lands after it is accepted for delivery, like the inbox or the spam folder.DNS (Domain Name System) is like the telephone directory of the internet. It's a record of all domain names (like myemma.com) on the web.Sending Domain is the domain (after the "@" in an email address) used to send emails. This should always be a domain that you or your organization own. Don't own a domain? Check out our article about domain names and registrars. It's also useful to know that every email has two "from" addresses: Header-From / Friendly From is the address we're all familiar with in our inbox, like "sally@mycompany.com". It's meant to be read and understood by humans receiving the email.Envelope-From / Return-Path is the address we don't usually see in the inbox, and it looks like "1234567.8901234.12345678910@e2ma.net". It's meant to be read and understood by the machines sorting incoming emails. ✎NoteSetting up email authentication requires some technical knowledge because you'll need to access and create DNS records for your sending domain. If you're uncertain how to do this, ask your IT team or your domain provider for help. DKIM What You Need to Know DKIM (Domain Keys Identified Mail) allows a mailbox provider (like Gmail, Yahoo, Outlook) to verify that an email's content hasn't been tampered with or changed in transit and the Friendly From address (the one for humans) matches the DKIM record domain. DKIM authentication happens in two parts, one on the sender side and the other at the receiving end. Sending: The Emma system generates an alphanumeric code (let's call it code 1) that represents the Friendly From address and email content. The system then encrypts code 1 and sends it with your email.Receiving: When the mailbox provider receives your email, it generates its own alphanumeric code (let's call it code 2). It then encrypts code 2 and compares code 2 with code 1. If both codes match then, your email hasn't been tampered or changed while in transit. ⚠WarningWithout DKIM, many major inbox providers will either mark your emails as spam or reject them outright. For more information about how DKIM works and why it’s important, check out our DKIM and Deliverability article. What You Need to Do All Emma accounts should set up DKIM authentication, as this helps distinguish your emails from other email senders and builds your unique domain reputation as a trusted email sender. Some major inbox providers, such as Gmail and Yahoo, actually require DKIM and will reject emails without it. DMARC What You Need to Know DMARC (Domain-based Message Authentication, Reporting & Conformance) combines parts of SPF and DKIM authentication to tell mailbox providers what to do with unauthenticated emails. It was created to destroy the deliverability of email senders who forge or fake other people's sending domain, also known as spoofing. Some major inbox providers require DKIM, DMARC, and SPF authentication for anyone sending through an email service provider (ESP), such as Emma. What You Need to Do Before creating a DMARC policy for your domain, you need to correctly set up DKIM authentication for your Emma account. If not, you risk a large segment of your emails being rejected by mailbox providers. Once you’ve completed your DKIM setup, then you can move forward with adding a DMARC policy on your domain. ⒾInfoEmma Support cannot troubleshoot delivery problems for accounts that do not have DKIM and DMARC set up. SPF What You Need to Know SPF (Sender Policy Framework) authentication checks the DNS records of the domain in the return-path address (the one for the machines), and the IPs authorized to send emails for that domain. If a sender's IP address is not listed in the DNS records of the return-path domain, their email is rejected. ✎NoteThe return-path domain for all emails coming from Emma is e2ma.net. This cannot be changed. SPF alignment is partially determined by an email's return-path, thus all mailings sent from Emma will only partially pass SPF, even if the sender has added Emma to their SPF record. This is another reason why setting up DKIM is so important. What You Need to Do We manage the SPF record for our sending domain, but you can also include Emma's domain in your SPF record. If you already have an SPF record you can edit the existing SPF record and include "_spf.e2ma.net". Otherwise, you'll need to create an SPF record and include "_spf.e2ma.net" in it. More information on SPF records in general can be found at open-spf.org. Allowlisting What You Need to Know If you are experiencing delivery trouble when sending from one domain to the same domain, or internal delivery trouble, then allowlisting is one of the most helpful steps that you can take to fix it. Allowlisting is essentially giving permission for a specific domain or IP range to have access to a certain privilege, such as delivering emails. What You Need to Do Your IT team should be able to allowlist Emma’s sending IP addresses so that your server knows that Emma has permission to send on your behalf. For more information on allowlisting, how to allowlist, and alternatives to allowlisting by IP range, please refer to our Allowlist Emma’s Addresses article. ☑TipWe recommend setting up allowlisting at all points where incoming emails are checked, as other forms of authentication can be affected by internal relays or hops through multiple servers. Additional Resources Allowlisting Emma's AddressesDeliverability HubDeliverability: Video LibraryDKIM and DeliverabilityDKIM Authentication SetupDKIM for Tiered AccountsDMARC Authentication SetupDomain Names and RegistrarsEmail Authentication: Frequently Asked QuestionsEmail Authentication: SecuritySPF Authentication SetupTitleEmail Authentication: OverviewURL NameCommon-Email-Authentication-Protocols