Email deliverability guides
Three related checks, with different jobs. Understanding which domain each check uses helps you investigate authentication across your marketing, transactional, and application email.
| Check | What it evaluates | What it does not establish |
|---|---|---|
| SPF | Whether the connecting server is authorized for the envelope sender’s domain. SPF can also evaluate HELO in applicable cases. | That the visible From address belongs to the same domain, or that the message will reach the inbox. |
| DKIM | Whether a signature from a signing domain verifies against the message’s signed content and headers. | That the signing domain matches the visible From domain, or that the recipient wants the message. |
| DMARC | Whether a successful SPF or DKIM result aligns with the domain in the visible From address, under the applicable alignment mode. | A guarantee of delivery, safety, or inbox placement. |
Protocol references: SPF, DKIM, and DMARC. Provider requirements are an additional layer.
EXPERTISE IN ACTION
A vendor can pass SPF for its own envelope domain and sign with its own DKIM domain. Those checks do not automatically authenticate your visible From domain for DMARC. Compare the identities used by the actual message.
For a simplified relaxed-alignment example, a message from receipts@example.com could use a passing DKIM signature from mail.example.com. An unrelated vendor.example.net signature would not create that relationship. Strict alignment requires an exact domain match.
DMARC does not require both SPF and DKIM to align for every message. A successful aligned result from either method can satisfy it. A mailbox provider’s sender rules can nevertheless require you to configure both methods, so check protocol results and provider requirements separately.
Forwarding can change the connecting server used for SPF, and message modifications can affect DKIM. Review the received message and its route before concluding that the original sending platform is misconfigured.
EXPERTISE IN ACTION
Include marketing tools, billing systems, support platforms, and application email. Record the visible From domain, envelope sender, DKIM signing domain, and the team responsible for each source.
Use recipient-side results and complete headers to compare SPF, DKIM, and DMARC outcomes. Check more than one flow: a correctly configured campaign platform does not establish that password resets or invoices are configured the same way.
The Gmail sender guidelines distinguish all senders from higher-volume senders. Microsoft’s high-volume requirements apply to its Outlook.com consumer service. Do not assume that one provider’s rules describe every corporate gateway.
Identify legitimate sources and review the evidence before tightening enforcement. Coordinate ownership, rollout, and a way to detect affected mail. A monitoring policy does not request the same handling as a quarantine or reject policy, and receiving systems retain their own decisions.
LET’S MAKE EMAIL DELIVER.
Authentication is one part of the sending environment. Our ongoing postmaster service connects it with reputation, provider responses, and the flows your business depends on.
