# Email authentication

> The DNS and cryptographic mechanisms receivers use to verify sending identities and domain authorization.

- **Category:** Authentication
- **Updated:** July 2026
- **Canonical page:** [https://emailbump.com/glossary/email-authentication](https://emailbump.com/glossary/email-authentication)

## Definition

Email authentication is the combined identity layer formed by SPF, DKIM, and DMARC. SPF evaluates whether an IP is authorized for an envelope domain. DKIM validates a domain-backed signature over selected headers and body content. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain and adds policy and reporting.

Authentication proves control of technical identities; it does not prove that a message is wanted, safe, accurate, or well targeted. Authenticated spam is still spam.

## Why it matters

Authentication helps receivers distinguish authorized infrastructure from direct domain spoofing. It is also a baseline sender requirement at major mailbox providers and creates durable domain identity across infrastructure changes.

## How it works

1. The domain owner publishes SPF, DKIM keys, and DMARC policy in DNS.
2. The sender constructs the envelope, signs the message, and transmits it.
3. The receiver queries DNS and evaluates SPF and DKIM.
4. DMARC compares the authenticated domains with the visible From domain and produces a pass or fail.

## Example: The authentication stack

```text
Visible From     news@example.com
Return-Path      bounce@mail.example.com  → SPF pass + aligned
DKIM signature   d=mail.example.com        → DKIM pass + aligned
DMARC            pass                      → one aligned pass is enough
```

## Common mistakes

- Treating SPF, DKIM, and DMARC as three independent checkboxes.
- Passing SPF or DKIM on a provider domain that does not align with the visible From domain.
- Publishing records without testing every legitimate sender and forwarded path.
- Assuming authentication guarantees inbox placement.

## Key takeaways

- Authentication creates verifiable identity, not permission.
- DMARC alignment connects technical authentication to the visible From domain.
- Configure and monitor every sending service that uses the domain.

## Related definitions

- [Sender Policy Framework](https://emailbump.com/glossary/spf.md) — A DNS policy that authorizes IP addresses to use a domain in the SMTP envelope.
- [DomainKeys Identified Mail](https://emailbump.com/glossary/dkim.md) — A cryptographic signature that lets a domain take responsibility for selected message content.
- [Domain-based Message Authentication, Reporting, and Conformance](https://emailbump.com/glossary/dmarc.md) — An alignment, policy, and reporting layer that connects SPF or DKIM to the visible From domain.
- [Sender reputation](https://emailbump.com/glossary/sender-reputation.md) — A receiver-specific assessment of sending identity and behavior used when filtering email.

## Related guides

- [How to A/B test email service providers without fooling yourself](https://emailbump.com/blog/ab-test-email-service-providers.md) — A rigorous guide to ESP evaluation: experimental design, reputation confounders, delivery and latency metrics, webhook reliability, failover, cost, and migration.
- [Gmail reputation-based bounces: diagnose, contain, and recover](https://emailbump.com/blog/gmail-reputation-bounces.md) — An incident guide to Gmail 4.7.x and 5.7.x responses, sender-level classification, safe retries, Postmaster Tools, abuse containment, and reputation recovery.
- [How to check your email domain reputation—and improve it](https://emailbump.com/blog/check-email-domain-reputation.md) — A practical guide to authenticated sending domains, Google Postmaster Tools, reputation signals, investigation workflows, stream separation, and recovery.
- [Why Gmail shows “via”—and how to fix your sender identity](https://emailbump.com/blog/gmail-via-label-dkim-alignment.md) — A practical guide to the domains behind Gmail’s via label, aligned DKIM and SPF, third-party senders, forwarding, and the headers that reveal the real problem.
- [DMARC in 2026: how it fights phishing—and where it stops](https://emailbump.com/blog/dmarc-phishing-protection.md) — A practical guide to domain alignment, reporting, safe enforcement, and the phishing attacks DMARC cannot solve on its own.
- [The email deliverability checklist for every campaign](https://emailbump.com/blog/email-deliverability-checklist.md) — A practical pre-send routine for protecting your sender reputation and reaching more inboxes.

## Primary sources

- [Google: Email authentication requirements](https://support.google.com/mail/answer/81126?hl=en)