# Email Authentication

# About

Email authentication (or email validation) is a collection of protocols (DKIM, SPF and DMARC)used to verify the source and legitimacy of email messages.

By implementing these records, you improve email deliverability and help protect from scammers trying to spoof your identity.

# DKIM

DKIM (DomainKeys Identified Mail) is a specialised DNS record that signs a message to prove an email actually came from the source domain.

A DKIM record can be enabled on a per domain basis.

# Enable DKIM

To enable DKIM on a domain:

  1. Open Websites in the left side bar
  2. Select the website you would like to enable DKIM
  3. Select Domains from the top menu and select the domain you would like to enable DKIM on
  4. Scroll to Email authetication and toggle DKIM On
  5. If the DNS is hosted with Enhance wait for validation. If the DNS is hosted elsewhere, follow the instructions on screen to complete authentication.

# DMARC

DMARC tells receiving servers how to handle fraudulent emails that fail domain authentication checks.

Enhance automatically adds a DMARC record to all zones with the policy p=none. This can be overridden with the DNS template feature under Settings > Platform > DNS > DNS zone templates if a custom record is required. This can be updated on a per domain basis.

The three DMARC policy types are;

Policy Type DNS Tag Syntax Action Taken on Failed Emails Primary Purpose
None (Monitor) p=none Delivered normally to the recipient's inbox. Data gathering and monitoring.
Quarantine p=quarantine Sent to spam/junk or held for review. Testing enforcement with minimal disruption.
Reject p=reject Blocked entirely from being delivered. Maximum security against domain spoofing.

# SPF

An SPF (Sender Policy Framework) record is a record which states exactly which mail servers are authorised to send emails on your behalf.

Enhance automatically adds an SPF recordto every new DNS zone which covers the assigned application and email servers using the "a" and "mx" selectors (v=spf1 a mx ~all). This can be overridden with the DNS template feature under Settings > Platform > DNS > DNS zone templates if a custom record is required. This can be updated on a per domain basis.