# Email Authentication
# About
Email authentication (or email validation) is a collection of protocols (DKIM, SPF and DMARC)used to verify the source and legitimacy of email messages.
By implementing these records, you improve email deliverability and help protect from scammers trying to spoof your identity.
# DKIM
DKIM (DomainKeys Identified Mail) is a specialised DNS record that signs a message to prove an email actually came from the source domain.
A DKIM record can be enabled on a per domain basis.
# Enable DKIM
To enable DKIM on a domain:
- Open Websites in the left side bar
- Select the website you would like to enable DKIM
- Select Domains from the top menu and select the domain you would like to enable DKIM on
- Scroll to Email authetication and toggle DKIM On
- If the DNS is hosted with Enhance wait for validation. If the DNS is hosted elsewhere, follow the instructions on screen to complete authentication.
# DMARC
DMARC tells receiving servers how to handle fraudulent emails that fail domain authentication checks.
Enhance automatically adds a DMARC record to all zones with the policy p=none. This can be overridden with the DNS template feature under Settings > Platform > DNS > DNS zone templates if a custom record is required. This can be updated on a per domain basis.
The three DMARC policy types are;
| Policy Type | DNS Tag Syntax | Action Taken on Failed Emails | Primary Purpose |
|---|---|---|---|
| None (Monitor) | p=none | Delivered normally to the recipient's inbox. | Data gathering and monitoring. |
| Quarantine | p=quarantine | Sent to spam/junk or held for review. | Testing enforcement with minimal disruption. |
| Reject | p=reject | Blocked entirely from being delivered. | Maximum security against domain spoofing. |
# SPF
An SPF (Sender Policy Framework) record is a record which states exactly which mail servers are authorised to send emails on your behalf.
Enhance automatically adds an SPF recordto every new DNS zone which covers the assigned application and email servers using the "a" and "mx" selectors (v=spf1 a mx ~all). This can be overridden with the DNS template feature under Settings > Platform > DNS > DNS zone templates if a custom record is required. This can be updated on a per domain basis.