You are here:
Authentication
Email authentication is like showing your ID to prove that you are who you say you are. Mailbox providers (MBPs) and spam filters check for authentication to verify that your emails come from a legitimate source. Authenticate your emails with DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF). Most MBPs, including Gmail and Microsoft, use these methods along with DMARC (Domain Message Authentication Reporting and Conformance), when they evaluate incoming messages.
SPF
Sender Policy Framework (SPF) prevents phishing and unauthorized domain use by identifying authorized senders for your business. When configuring an SPF policy, an IT or web admin adds a Domain Name Service (DNS) TXT record to the envelope domain. That record specifies the IP addresses that can send email on your behalf.
During email delivery, receiving mail servers query this record to verify the sending server's authorization. The DMARC standard introduces an additional requirement for SPF evaluation called identifier alignment. When you pass DMARC, your SPF policy authorizes the sending IP and matches the domain used in the From address.
DKIM
A DKIM (DomainKeys Identified Mail) signature acts like a seal that protects the content of your email from changes during transit. Receiving mail servers check the signature, and pass messages through when the signature matches a public key.
Work with your domain registrar to add the Salesforce-generated public key to your DNS record. Then store the private key with Salesforce so that we can sign outgoing messages.
DMARC
DMARC (Domain Message Authentication Reporting and Conformance) picks up where DKIM leaves off. It tells receiving servers how to handle emails that have failed authorization checks.
An admin can configure DMARC policies with your domain registrar.
If you’re new to DMARC, start in monitoring mode. The system delivers unauthenticated emails and logs a report, allowing you to investigate DKIM or SPF failures without impacting customer engagement. After everything works properly, select the strictest policy to protect your brand and business.
Further Reading
To find detailed information and instructions about authentication for each marketing app, review this table.
- Marketing Cloud Next: Authenticate a Domain for Unified Messaging
- Marketing Cloud Account Engagement: Add and Verify a Domain for Email Sending
- Marketing Cloud Engagement: Add and Verify a Domain for Email Sending, Reply Mail Management
