SPF, DKIM, DMARC & BIMI: The Developer's Email Authentication Guide
Email authentication isn't optional anymore. Gmail and Yahoo now require SPF, DKIM, and DMARC for bulk senders. Here's how each protocol works, how to configure them, and how to verify your setup.
Email authentication requires four interlocking protocols: SPF authorizes sending IPs, DKIM signs message contents cryptographically, DMARC enforces domain alignment and failure handling (p=reject), and BIMI displays verified brand avatars. Senders must maintain SPF lookups under the 10-DNS limit and achieve strict DMARC alignment to reach recipient primary inboxes.
Why email authentication matters
Gmail and Microsoft now require SPF and DKIM for bulk senders, and strongly recommend DMARC. Without proper authentication, your emails are more likely to be flagged as spam or rejected outright. Google's February 2024 enforcement means senders of 5,000+ daily emails must have all three configured.
Authentication also protects your domain from spoofing, preventing others from sending email that appears to come from your organization.
The implementation order
Set these up in order. Each protocol builds on the previous one:
- SPF: authorize your sending servers
- DKIM: sign your emails cryptographically
- DMARC: set policy for authentication failures (start with
p=noneto monitor) - BIMI: add your brand logo (optional, requires DMARC enforcement)
SPF, Sender Policy Framework
Defines which mail servers are authorized to send email on behalf of your domain. Receiving servers check the SPF record to verify the sending server's IP is listed.
v=spf1 include:_spf.google.com include:sendgrid.net ~allCommon failures
- Too many DNS lookups (max 10 allowed, each 'include' counts as one)
- Missing your email service provider's servers in the SPF record
- Using '-all' (hard fail) before you've verified all senders, causing legitimate email to be rejected
- Forgetting to include servers for transactional email (e.g., Resend, Postmark) alongside marketing email (e.g., Mailchimp)
DKIM, DomainKeys Identified Mail
Adds a cryptographic signature to every outgoing email. The receiving server verifies the signature against a public key published in your DNS records. This proves the email hasn't been tampered with in transit.
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...Common failures
- Wrong selector name (must match what your email provider generated)
- Truncated public key (some DNS providers have a 255-character limit per TXT record, use multiple strings)
- Key rotation: forgetting to publish the new key before your provider switches to it
- Multiple DKIM records from different providers conflicting
DMARC, Domain-based Message Authentication, Reporting, and Conformance
Tells receiving servers what to do when SPF and DKIM fail: none (monitor only), quarantine (send to spam), or reject (bounce). Also enables aggregate reporting so you can see who's sending email as your domain.
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100Common failures
- Starting with p=reject before monitoring causes legitimate email to bounce
- Not setting up a reporting address (rua=): you'll never know about failures
- Third-party senders (CRM, marketing tools) that don't align with your SPF/DKIM
- Subdomain policy not set (sp=): attackers may spoof subdomains instead
BIMI, Brand Indicators for Message Identification
Displays your brand logo next to your email in the inbox. Requires DMARC enforcement (p=quarantine or p=reject) and a Verified Mark Certificate (VMC) from a certificate authority. The newest of the four protocols.
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pemCommon failures
- DMARC not at enforcement level (p=none won't work, need quarantine or reject)
- SVG logo not in the required Tiny PS format (specific profile required by BIMI)
- VMC certificate expired or from a non-recognized authority
- Logo not matching the trademarked logo exactly
Debugging authentication failures
When emails are rejected or land in spam, check the email headers for authentication results. Look for:
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of sender@yourdomain.com)
dkim=pass header.d=yourdomain.com
dmarc=pass (p=QUARANTINE) header.from=yourdomain.comIf any result shows fail or softfail, trace the issue: verify the DNS record exists, check that the sending IP is authorized (SPF), confirm the DKIM selector matches, and ensure DMARC alignment between the From header and the authenticated domain. Learn how to parse these feedback loops in our guide on how to read DMARC reports, navigate policy transitions with DMARC policy modes, and lock down organizational domains via DMARC subdomain records.
Checking your setup with Emailens
Emailens includes a deliverability checker that verifies all four protocols for your domain: SPF record validity, DKIM key publication, DMARC policy configuration, and BIMI record presence. It flags misconfigurations and suggests fixes.
You can try it from the deliverability tool page or run it as part of a full email preview from your dashboard.
Frequently Asked Questions
What is the difference between SPF and DKIM?
SPF authorizes specific IP addresses and mail servers to send emails on behalf of your domain name. DKIM provides cryptographic proof that the message contents were signed by the domain owner and were not tampered with during transit.
Why do Google and Yahoo require DMARC?
Starting in 2024, Google and Yahoo enforce mandatory DMARC policies for bulk senders (5,000+ messages/day) to prevent domain spoofing, phishing, and impersonation, blocking or routing unauthenticated mail to spam.
What is DMARC alignment?
DMARC alignment requires that the domain in the visible 'From' header matches the domain verified by SPF (the Return-Path domain) or the domain verified in the DKIM 'd=' tag.
What are the prerequisites for implementing BIMI?
BIMI (Brand Indicators for Message Identification) requires an active DMARC enforcement policy ('p=quarantine' or 'p=reject' at pct=100) and, for major providers like Gmail, a Verified Mark Certificate (VMC) certifying trademark ownership.
Check your domain's email authentication
Verify SPF, DKIM, DMARC, and BIMI in one click, with actionable fix suggestions for every failure.
Check your domainFree plan, 30 previews/day
- •Google Support: Google Workspace Admin: Email Sender Guidelines & Requirements
- •IETF RFC: IETF RFC 7208: Sender Policy Framework (SPF)
- •IETF RFC: IETF RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- •IETF RFC: IETF RFC 7489: Domain-based Message Authentication (DMARC)
Reviewed by Philippe KAM · Last updated: Mar 4, 2026
Building next-generation email preview and QA infrastructure for developers. Focused on reverse-engineering rendering engines across Outlook (Word MSO & New Outlook), Gmail, and Apple Mail to eliminate email rendering bugs before dispatch.