Email Authentication Explained in Plain English

Why any of this exists

Email was designed in the early 1980s with no way to check who sent a message. The From line is just text. Anyone can type anything into it. There is no password on it and nothing verifies it.

That is not a bug someone forgot to fix. It is how the protocol was built. It is also why phishing works. A scammer can send a message that says it comes from your business, to your customers, asking them to pay an invoice, and nothing in the original design stops them.

SPF, DKIM and DMARC are three patches bolted on afterward to fix that hole. BIMI is a reward you get once the first three are working. That is the whole story. Everything below is detail.

First, what is a DNS record?

All four of these work the same way. You publish a short line of text in your domain's DNS, and mail servers around the world read it.

DNS is the public directory for your domain. It is what tells a browser which server to load when someone types your web address. It also holds notes that anyone can look up. Those notes are called records.

You edit them wherever your domain lives: GoDaddy, Namecheap, Cloudflare, Squarespace. Look for DNS settings or DNS management. Everything in this article is a TXT record, which is DNS for a line of plain text anyone can read.

There is nothing secret in any of them. They are public by design. Anyone can read yours right now, and you can read your competitor's.

SPF: the guest list

SPF stands for Sender Policy Framework. It is a list of the mail servers allowed to send email using your domain.

Picture a guest list at a door. You write down every service that sends mail on your behalf: your Google Workspace or Microsoft 365, your newsletter platform, your store software, your invoicing tool, your booking system. When a message arrives, the receiving server checks whether it came from one of those. If not, it is not on the list.

You get exactly one SPF record per domain. Publishing a second one is a common and quiet mistake. It does not give you double coverage. It breaks SPF completely.

DKIM: the tamper-evident seal

DKIM stands for DomainKeys Identified Mail. Your mail provider adds an invisible cryptographic signature to every message it sends. The matching key sits in your DNS for anyone to check against.

Think of a wax seal on an envelope. The receiving server reads the seal, looks up your published key, and confirms two things: the message really came from your domain, and nobody altered it in transit.

DKIM is sturdier than SPF because it survives forwarding. When someone forwards your email, SPF usually breaks, since the message now arrives from a server that was never on your guest list. The DKIM seal travels with the message itself.

If your provider gives you a choice of key length, pick 2048-bit. Google treats 1024 as the floor and recommends 2048.

DMARC: the one that actually matters

Here is the part that surprises people, and it is the single most useful thing to understand.

Every email has two From addresses. The visible one you see in your inbox, and a hidden one used for bounce handling. SPF checks the hidden one. DKIM checks whichever domain signed the message. Neither of them is required to have anything to do with the name your customer actually reads.

So a scammer can pass SPF perfectly, using their own domain in the hidden field, while putting your business name in the visible one. The check passes. The customer still sees you. SPF and DKIM on their own do not stop impersonation.

DMARC closes that gap, and it does two jobs. First, it requires alignment: the visible From domain has to match the domain that passed SPF or DKIM. Second, it tells receiving servers what to do when that fails.

There are three settings. p=none means watch and report, but deliver anyway. p=quarantine means route it to spam. p=reject means refuse it at the door.

DMARC is also the only one of the three that talks back to you. Add an rua address to the record and mailbox providers will email you daily summaries listing every server sending as your domain. This is how business owners discover that a shipping app, an old CRM, or a former agency has been sending as them for years. The raw reports arrive as XML, which is not readable by a human, so you will want a free report parser to turn them into something legible.

• The record lives at _dmarc.yourdomain.com as a TXT record
• A minimal starting record looks like: v=DMARC1; p=none; rua=mailto:you@yourdomain.com
• v=DMARC1 must come first, and the p= tag must come immediately after it
• Add sp= to control subdomains. Leave it out and a forgotten subdomain can stay wide open

BIMI: your logo in the inbox

BIMI stands for Brand Indicators for Message Identification. It puts your logo in the small circle beside your name in the inbox, where the sender's initial normally sits.

BIMI does not make your email more secure. It changes nothing about deliverability on its own. It is a display feature, and it is the visible payoff for having done the first three properly. It is also strictly gated. Your DMARC has to be at quarantine or reject before any mailbox provider will show it.

The record goes at default._bimi.yourdomain.com and looks like this: v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/cert.pem

Two things reliably break it. The logo has to be SVG Tiny Portable/Secure, which is a specific restricted profile, not a normal SVG. A default export from Illustrator or Figma will not validate. And a pct value below 100 anywhere in your DMARC record disqualifies you, even though the record itself looks fine.

The certificate question, answered honestly

To show a logo in Gmail or Apple Mail you need a certificate, and this is where real money enters the picture for the first time.

A VMC, or Verified Mark Certificate, requires a registered trademark and runs roughly $1,200 to $1,500 a year at list price. A CMC, or Common Mark Certificate, needs no trademark. Instead you prove twelve months of documented public use of the logo on a domain you control, often via the Internet Archive. It costs a few hundred less.

The BIMI Group directory lists three: DigiCert, GlobalSign and SSL.com. Sectigo is issuing too, despite not appearing there, and Entrust dropped off the issuer list in May 2025. If someone offers to sell you a VMC from anywhere else, they are reselling from one of those three, which is fine, but know what you are buying.

Only a VMC produces the blue checkmark in Gmail. A CMC shows the logo without it. Apple Mail accepts VMC only. Certificates max out at 397 days, so this is an annual renewal, not a one-time purchase. Put the renewal date in your calendar the day you buy, because the logo simply disappears when it lapses.

We went through this on our own store, Bench Clearers. GlobalSign VMC, BIMI live in Gmail, logo and blue check showing. We paid under $800 through a reseller rather than list price. We also learned that the logo has to match your registered trademark exactly, and the file has to byte-match the one embedded in the certificate. A logo that is merely very close will fail.

The order. This part is not negotiable.

Each step depends on the one before it. Doing them out of order is how people break their own email.

One: publish SPF, and list every service that sends on your behalf. Two: turn on DKIM in every one of those services, each of which gives you records to publish. Three: publish DMARC at p=none with an rua address, and actually read the reports. Four: fix what the reports reveal, then move to quarantine, then reject. Five, and only now: BIMI, Apple Branded Mail, and a certificate if you want one.

Steps one through four are free. They are DNS records and attention. The only cost is time and a report parser, and there are usable free tiers for those.

One more reason to care beyond phishing. If you send 5,000 or more messages a day to Gmail, Yahoo or Microsoft consumer addresses, all three now require SPF, DKIM, DMARC and alignment, and they reject non-compliant mail outright with a 550 5.7.515 error rather than filing it in spam. Microsoft's enforcement landed in stages through late 2025. Under that volume you are still expected to have SPF or DKIM and keep spam complaints below 0.3%.

When you should not bother

We would rather say this plainly than sell you something you do not need.

If you send a few hundred emails a month from a normal Google Workspace or Microsoft 365 account, do SPF, DKIM and DMARC. Stop there. They are free, they take an afternoon, and they are the entire security benefit. Skip BIMI.

Do not buy a VMC or a CMC before your DMARC is at quarantine or reject. The certificate will sit unused and the clock on its 397 days starts anyway. Reversing that order is pure wasted money.

And if your logo is a wordmark you have never registered and never published consistently, a VMC is not available to you and a CMC may not be either. That is a real answer, not a problem to be worked around. Nobody can promise you a logo in the inbox. Gmail, Apple and the certificate authorities each decide on their own terms, and anyone guaranteeing an outcome is telling you something they cannot know.

Working with us

We are Verified Everywhere, part of JWC Apps in San Diego. We ran this exact stack end to end on our own business first, a hockey apparel store called Bench Clearers, which is how we know where it breaks. We work only through official channels, we never ask for your passwords, ID documents or card numbers, and if we look at your setup and do not believe it can succeed, we will tell you that and decline rather than take the fee.