If you're sending marketing emails, you need email authentication. Without it, inbox providers like Gmail, Yahoo, and Outlook have no way to verify that your emails are actually coming from you — and not from a spammer impersonating your domain.
Email authentication is a set of DNS records that prove to receiving mail servers that you are authorized to send email from your domain. There are three main protocols: SPF, DKIM, and DMARC.
SPF (Sender Policy Framework)
SPF lets you publish a list of IP addresses and servers that are authorized to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks your SPF record to see if the sending server is on the list.
An SPF record looks like this in your DNS:
v=spf1 include:mail.nexsent.in ~allThis says: "emails from my domain should come from the servers listed at mail.nexsent.in. Treat anything else with suspicion."
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every email you send. The receiving server looks up your public key (stored as a DNS record) and verifies that the email hasn't been tampered with in transit.
Unlike SPF, DKIM survives email forwarding — which makes it the more reliable of the two for proving authenticity.
A DKIM DNS record is a TXT record on a subdomain like nexsent._domainkey.yourdomain.com containing your public key.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together with a policy. It tells receiving servers what to do when an email fails both SPF and DKIM checks — should it be quarantined, rejected, or allowed through?
A basic DMARC record looks like:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.comThe p=quarantine policy tells servers to send failing emails to spam. As you build confidence, you can upgrade to p=reject for maximum protection.
Why All Three Matter
Each protocol covers a different aspect of email trust:
- SPF verifies the sending server is authorized
- DKIM verifies the email content hasn't been altered
- DMARC provides a policy for handling failures
Together, they form a complete authentication chain. Major providers like Gmail now require SPF and DKIM for bulk senders (as of February 2024), and DMARC is strongly recommended.
Setting It Up with NexSent
NexSent makes authentication easy. When you add a sending domain, we automatically generate the exact DNS records you need — SPF include directive, DKIM public key, and a recommended DMARC policy. Just copy them into your DNS provider, and our system verifies them automatically.
No manual key generation, no guesswork. Your domain health dashboard shows green checkmarks when everything is configured correctly.