THE RAY EMAIL AUTHENTICATION GUIDE
SPF, DKIM, and DMARC.
Know what to check.
Know what to fix.
Legitimate email can fail authentication. Unfamiliar senders can use your domain. Start by understanding the records, the signatures, and the policy that connect them.
Check my domain free Public DNS check · No signup · No DNS credentialsSPF: check who is allowed to send.
Sender Policy Framework publishes the servers allowed to send for a domain used in the SMTP envelope. That domain is not always the address a recipient sees in the From line.
What to investigate: missing or conflicting SPF records, old sending services, and a record that exceeds the DNS lookup limit. A published SPF record is configuration evidence; it is not a complete inventory of actual senders.
Ray’s free domain check gives you a starting point in public DNS. Your email and DNS providers are where you make the changes.
DKIM: check the signature and the domain.
DomainKeys Identified Mail lets a receiver verify a message’s cryptographic signature using a public key in DNS. The signing domain can differ from the visible From domain.
What to investigate: missing published keys, a sending platform that is not signing correctly, or a signature that passes but does not align for DMARC. DKIM records use selectors, so a DNS check cannot automatically discover every key or prove how every message is signed.
Connected DMARC reports add evidence about reported authentication and alignment results from real sending activity.
DMARC: protect the domain people recognize.
DMARC connects authentication to the visible From domain. A message can pass DMARC through aligned SPF or aligned DKIM. Passing SPF or DKIM on an unrelated domain is not enough.
A DMARC policy can request monitoring, quarantine, or rejection for messages that fail. The receiver ultimately decides how to handle a message. Read the DMARC overview.
What to investigate: a missing policy, legitimate senders failing alignment, and unfamiliar sources. A monitoring policy can be an intentional first step. An unknown source is a reason to investigate, not proof of abuse.
Move toward enforcement with evidence.
Start with the senders your business relies on: your email platform, campaigns, support, invoices, and account notifications. Connect aggregate reporting, review legitimate services, and fix authentication gaps before tightening the policy.
Ray brings observed sender activity and DMARC results together as reports arrive. Hourly DNS checks and email alerts help you notice configuration changes after a fix. Explore DMARC monitoring plans.
Authentication is one part of deliverability. Reputation, content, recipient engagement, and mailbox-provider rules also matter. Review Gmail’s sender guidelines alongside your provider’s requirements.
MTA-STS and TLS-RPT: watch the connection.
MTA-STS lets a receiving domain publish a policy for encrypted SMTP delivery and trusted server certificates. It addresses transport security, while SPF, DKIM, and DMARC address authentication.
TLS-RPT provides reports about transport-security successes and failures. Review these reports to investigate certificate, policy, or connection problems reported by participating senders.
Ray helps you inspect MTA-STS configuration and review TLS reports. Keep control of DNS and policy decisions. See the standards for MTA-STS and TLS-RPT.
Start with your sending domain.
Run a free public DNS check. Review the findings with your domain or sending-platform owner. Connect reporting when you need sender history and ongoing monitoring.
Check my domain free