Email Authentication: Expert Tips for SPF, DKIM, DMARC, and Beyond

Reverse DNS & PTR Records – validating sending IPs

Reverse DNS records, also called pointer (PTR) records, are an additional method for securing emails from attackers. When you provide a PTR record, the recipient email server can perform a reverse DNS lookup by attempting to match your device’s IP address with the associated email domain.

How reverse DNS lookups work (step-by-step):

1. The email server receives an email → The server checks for a PTR record.
2. The server checks to see if the IP address matches the sending domain → If it matches, the email is more likely to be delivered
3. If no PTR record exists → Email may be marked as spam or rejected.

Best practices for reverse DNS and PTR records

• Ensure every sender has a PTR record that matches the domain.
• Only use one PTR record per IP address.
• Name your domains in a way that makes it function clear to avoid inaccuracies.
• Align your PTR records with the information found in SPF records.

Brand Indicators for Message Identification (BIMI) – visual email authentication

Though not a requirement, BIMI is an email authentication specification that allows a company to customize and display its logo next to their emails. However, you can’t just upload any image file. You need to provide an SVG file with the following parameters:

• Save the file SVG Tiny 1.2
• Square aspect ratio
• Solid color background
• Company logo centered

In addition to providing a valid SVG, you also need to have an active DMARC policy set to either quarantine or reject.

After meeting the requirements, you can submit your BIMI logo along with proof of company ownership to a third party. In exchange, you’ll receive a Verified Mark Certificate (VMC) to include with your BIMI record. Trusted popular third party verifiers include companies like DigiCert and Entrust.

How BIMI works:

1. Email is sent → the recipient checks for DMARC compliance
2. If the DMARC check passes → the recipient performs a BIMI check. If DMARC fails, no logo is displayed and the email is rejected or quarantined.
3. If the BIMI check passes → the email is delivered with a brand logo next to the subject line

Here’s an example of a BIMI record:

v=BIMI1; l=URL(path to logo here); a=URL(path to VMC here)

• v=BIMI1 – Indicates that this is a BIMI record using version 1
• l – This is where you’ll provide the URL to your BIMI SVG logo
• a – This is where you’ll provide the URL linking to your VMC

Best practices for BIMI

• Ensure that SPF, DKIM, and DMARC are configured correctly. DMARC must be set to quarantine or reject. BIMI is not compatible with a ‘none’ policy.
• The company logo should be up-to-date and clearly visible with a resolution at a minimum of 96x96. Use a solid background color that appropriately complements your logo in a square (1:1) format.
• Use SVG Tiny 1.2.
• File size must not exceed 32 kb.
• Check your BIMI record for accuracy using a free .

If you need help creating a BIMI record, you can use our by providing an appropriate SVG URL.

How to authenticate email

Here’s a rundown of the next steps you can take to ensure your emails are authenticated and compliant:

1. Set up your records – To maximize protection and email deliverability, consider all records mandatory. You can create SPF, DKIM, DMARC, PTR, and BIMI records free using a generator tool to help you with proper syntax. You can also consult your ESP for more information as some of these may already be in place.
2. Ensure there are no conflicting records – Continuing off step 1, check that there aren’t already existing email authentication records in place. Having multiple records will confuse recipient mail servers and lead to significant delivery issues.
3. Monitor your alignment – It’s not enough to rest on your laurels. After adding email authentication records, it’s your responsibility to use them to monitor your domain’s email activity as some methods like encryption keys can still be compromised.
   
   It’s recommended to use an active monitoring tool like DMARC Monitor to track all outbound emails using your email domain. With this, you can monitor passively and take action if you receive any automated alerts when emails are not aligned with email authentication and suspicious. It can also help you identify issues with your existing records.
4. Add a one-click unsubscribe – This is an additional email requirement. To set it up, ensure DKIM is present, and include these Google-recommended lines in your header:
   
   List-Unsubscribe-Post: List-Unsubscribe=One-Click
   
   List-Unsubscribe: https://solarmora.com/unsubscribe/example
5. Monitor spam complaint rate – While not directly connected to email authentication, a rise in spam complaint can indicate an issue with your email authentication. 78% of people will mark an email as spam simply because it “looks like” spam. Authentication like BIMI helps with this.
   
   Additionally, spam complaints must remain below 0.1% to avoid negative impacts on your email deliverability.

What happens if you don’t address email authentication?

If you don’t use email authentication, here’s what will happen:

• Spam folder placement – Email authentication helps bulk senders build trust with ISPs. Now that it’s a requirement by major providers, emails without authentication records are more likely to go to spam.
• Email rejections – Similar to the above, certain mail providers like Google, Yahoo, and Outlook may opt to reject any emails that aren’t authenticated as they pose a greater likelihood of being a threat.
• Declining email deliverability – If your email campaign performance drops, it may not be the email, it’s your deliverability (aka inbox placement). Without authentication, a higher percentage of your emails will bounce or go to spam, leading to decreased open and clickthrough rates.

Google and Yahoo agreed on enforcing email authentication

On February 1st, 2024, Google and Yahoo made changes that impacted every single company that sends emails worldwide.

Here’s a quick overview of those changes from the webinar:

Let’s break those details down. Here’s a closer look at what’s changing:

1. Email authentication is required – Specifically, businesses must use DMARC, SPF, and DKIM. The companies state that businesses that don’t use these protocols can expect a negative impact to their email deliverability.
   
   BIMI and rDNS aren’t currently included in these requirements. However, they’re strongly recommended and will provide similar email deliverability benefits over senders that aren’t using these authentication methods.
2. One-click unsubscribes are required – Every email you send must provide the recipient with a means of opting out with “one click.” You can add a one-click unsubscribe URL to the headers of your emails. Your ESP also provides this feature in the configuration menu.
   
   Unsubscribe links have always been a requirement for CAN-SPAM compliance. This new measure makes it easier for recipients to avoid emails they don’t want.
3. Keep your spam complaint rate below 0.3% – This is the current threshold for allowed spam complaints. However, we know from experience that anything higher than 0.1% will negatively impact your email deliverability. Spam complaints hurt your sender reputation and lower your trust.

These three rules apple to any person or organization sending 5,000 emails or more daily.

Failing to comply with these new rules and email authentication requirements will result in the following:

• Google and Yahoo may opt to reject your company’s emails
• A higher percentage of your emails will be marked as spam
• Your email deliverability and sender reputation will decline as long as you aren’t complying with these practices