The Minimum Email Authentication Every Brand Should Implement

Email authentication has evolved from a best practice into a business requirement. Whether you send newsletters, receipts, password resets, or marketing campaigns, your domains should be properly authenticated before a single message leaves your platform.

The good news is that the minimum standard is relatively straightforward. Every sending domain should have four core authentication technologies in place: SPF, DKIM, DMARC, and BIMI. Together, they protect your brand, improve deliverability, and help mailbox providers distinguish legitimate email from phishing attempts.

This article outlines the minimum authentication every organization should deploy and explains where each record belongs.

SPF: Identify Authorized Mail Servers

Sender Policy Framework (SPF) identifies which mail servers are authorized to send email on behalf of a domain. Receiving mail servers compare the sending IP address against the published SPF record.

SPF is often misunderstood. It authenticates the Mail From (also called the envelope sender or Return-Path), not the visible From address your recipients see.

Minimum recommendation

For every domain or subdomain used as the Mail From domain:

• Publish exactly one SPF record.
• Keep the record below the DNS lookup limit of ten mechanisms.
• Ensure all legitimate sending services are included.
• End the record with an appropriate policy, typically ~all or -all.

Limit: One SPF record per domain or subdomain.

Publishing multiple SPF records causes SPF evaluation to fail.

DKIM: Digitally Sign Every Message

DomainKeys Identified Mail (DKIM) uses public key cryptography to attach a digital signature to each message. The receiving server validates the signature using the public key published in DNS.

Unlike SPF, DKIM survives forwarding and provides assurance that important parts of the message have not been modified in transit.

Minimum recommendation

For every domain or subdomain used for DKIM signing:

• Publish a DKIM public key for each selector.
• Configure every sending platform to sign outgoing mail.
• Rotate keys periodically as part of normal security maintenance.

A domain may have multiple selectors active simultaneously. This makes key rotation and supporting multiple sending systems much easier.

Limit: One DKIM record per selector. Multiple selectors are allowed for the same domain.

DMARC: Ask Mailbox Providers What to Do

Domain-based Message Authentication, Reporting, and Conformance (DMARC) builds on SPF and DKIM by verifying that authenticated domains align with the visible From address. It also provides reporting so domain owners can see who is sending mail using their domain.

DMARC has become the foundation of modern email trust.

Minimum recommendation

• Publish a DMARC record at the apex domain.
• Configure reporting addresses (RUA) to receive aggregate reports.
• Move toward an enforcement policy after validating legitimate mail streams.

Subdomains inherit the organizational domain’s DMARC policy unless they publish their own record.

Limit: One DMARC record per domain (recommended) or subdomain.

Only create subdomain-specific records when different policies or reporting behaviour are required.

BIMI: Display Your Brand

Brand Indicators for Message Identification (BIMI) allows participating mailbox providers to display your verified brand logo beside authenticated email.

BIMI is not an email authentication protocol by itself. Instead, it builds on a properly authenticated domain that already has DMARC enforcement.

Minimum recommendation

• Publish a BIMI record at the apex domain.
• Host a valid SVG Tiny PS logo.
• Where required by participating mailbox providers, obtain a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).

Like DMARC, subdomains inherit the organizational BIMI record unless a separate BIMI record is published.

Limit: One BIMI record per domain or subdomain.

What Your ESP Should Add

While brands are responsible for authenticating their own domains, Email Service Providers also play an important role.

One recommendation that is becoming increasingly common is for the ESP to apply its own DKIM signature in addition to the customer’s DKIM signature.

This results in two independent DKIM signatures on each message:

• Brand DKIM: Authenticates the organization’s domain and satisfies DMARC alignment.
• ESP DKIM: Authenticates the sending platform.

The ESP signature serves several purposes:

• Supports provider-specific Feedback Loops (FBLs) that identify senders by DKIM domain.
• Allows mailbox providers to build reputation for the ESP’s infrastructure independently of the customer.
• Helps diagnose signing or configuration problems.
• Enables smoother customer migrations and infrastructure changes.

Importantly, the ESP DKIM signature should supplement, not replace, the customer’s aligned DKIM signature.

Putting It All Together

For most organizations, the minimum email authentication deployment looks like this:

A Few Common Mistakes

Even organizations that have implemented authentication often make avoidable mistakes:

• Publishing multiple SPF records for the same domain.
• Using the visible From domain as the SPF domain instead of the Mail From domain.
• Forgetting to enable DKIM signing after publishing the DNS record.
• Deploying DMARC without monitoring reports.
• Publishing BIMI before DMARC enforcement is in place.
• Allowing different business units or vendors to manage DNS independently without governance.

A periodic review of your authentication records helps catch these issues before they affect deliverability or customer trust.

Email authentication should be treated as core infrastructure, not an optional security feature. SPF, DKIM, DMARC, and BIMI work together to establish trust between your organization and mailbox providers, while protecting customers from spoofing and phishing.

For brands, implementing these four technologies represents the minimum modern authentication baseline. For ESPs, adding an independent DKIM signature provides additional operational, reporting, and reputation benefits that improve the overall health of the email ecosystem.

As authentication standards continue to evolve, organizations with a clean, well-managed foundation will be in the best position to adopt future improvements with minimal effort.