In short
Email authentication is a set of DNS-published standards that prove mail using your domain is genuine. SPF lists the servers allowed to send for you, DKIM signs each message, and DMARC ties both to the visible From address and tells receivers what to do with failures. MTA-STS protects mail in transit to you; BIMI shows your logo.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What each email authentication standard does
Email was designed without any way to prove who sent a message. Five standards now fill that gap, and each does a different job:
| Standard | What it does | Where it lives | Our guide |
|---|---|---|---|
| SPF (Sender Policy Framework) | Lists the servers allowed to send mail for the envelope (MAIL FROM) domain | One TXT record at the domain, starting v=spf1 | SPF record |
| DKIM (DomainKeys Identified Mail) | Adds a cryptographic signature that proves which domain signed the message and that it was not altered | A public key at selector._domainkey (TXT, or CNAME in Microsoft 365) | DKIM |
| DMARC | Checks that SPF or DKIM passes and aligns with the visible From domain, sets a policy for failures and asks for reports | TXT record at _dmarc | DMARC and DMARC policy not enabled |
| MTA-STS with TLS-RPT | Tells other servers to deliver mail to you only over verified TLS, and sends you reports on failures | TXT records at _mta-sts and _smtp._tls, plus a policy file on a web server | MTA-STS |
| BIMI | Shows your verified logo next to authenticated mail in supporting inboxes | TXT record, a logo file and a mark certificate | Covered below |
SPF, DKIM and DMARC protect other people from mail pretending to be you. MTA-STS protects mail coming to you while it crosses the internet. None of them filters the phishing your own staff receive, which is the job of an integrated cloud email security layer or a secure email gateway. Our guide to email spoofing explains where authentication stops and impersonation protection starts.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Why email authentication matters now
Two pressures have turned authentication from good practice into a requirement.
Mailbox providers now insist on it. Since 1 February 2024, Google has required every sender to personal Gmail accounts to use SPF or DKIM, and anyone sending around 5,000 or more messages a day to have SPF, DKIM and a DMARC record. Yahoo introduced matching rules at the same time, and Microsoft began enforcing similar rules for Outlook.com, Hotmail and Live addresses from 5 May 2025. Google says it began ramping up enforcement from November 2025, including temporary and permanent rejections. Our page on Google bulk sender guidelines sets out the detail.
Criminals impersonate exact domains. A fake invoice from your own domain, or from a supplier's, is far more convincing than one from a lookalike. Once your domain has a DMARC policy of quarantine or reject, receivers that honour DMARC stop delivering messages that fail it. That is why DMARC enforcement is a core part of invoice fraud prevention.
Authentication also helps your own deliverability. Google says authenticated messages are less likely to be rejected or marked as spam, and Microsoft's documentation recommends SPF, DKIM and DMARC together for every custom domain in Microsoft 365.
The order to deploy them
The NCSC's guidance, Email security and anti-spoofing, sets out an implementation plan for UK organisations. In outline:
- Choose an anti-spoofing management tool so you can read the DMARC and TLS reports, rather than raw XML.
- Protect email in transit: make sure your mail service supports TLS, then add MTA-STS and TLS-RPT in testing mode.
- Publish DMARC at p=none with a reporting address, so you can see every service sending as your domain.
- Create and iterate an SPF record that lists every legitimate sender and stays within the ten DNS lookup limit.
- Create and manage DKIM for Microsoft 365, Google Workspace and every other platform that sends as you.
- Monitor, analyse and update your records as the reports reveal senders you had forgotten.
- Mark spoof emails as spam by moving DMARC to quarantine.
- Reject spoof emails by moving DMARC to reject, then keep reviewing as services change.
Two practical points. First, include every domain you own, not just the one people use: parked and legacy domains are easy to spoof and should be locked down with an SPF record that allows nothing and a DMARC reject policy. Second, Google advises setting up SPF and DKIM at least 48 hours before you publish DMARC, so the first reports reflect your real set-up.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Email authentication in Microsoft 365 and Google Workspace
Both platforms handle part of the work for you, and both leave the DNS records to you. Where each task lives:
| Task | Microsoft 365 | Google Workspace |
|---|---|---|
| SPF include | include:spf.protection.outlook.com; Microsoft recommends ending with -all | include:_spf.google.com; Google recommends ending with ~all |
| DKIM for your domain | Off for custom domains until you enable it: Defender portal, Email authentication settings, DKIM tab, then two CNAME records | Admin console: Apps, Google Workspace, Gmail, Authenticate email; one TXT record (default selector google, 2048-bit recommended) |
| DMARC record | At your DNS host for custom domains; the onmicrosoft.com domain gets its DMARC record in the Microsoft 365 admin center | At your DNS host, as a TXT record at _dmarc |
| MTA-STS | Exchange Online checks other domains' policies automatically; you host your own policy file (Microsoft suggests Azure Static Web Apps) | Gmail honours enforce-mode policies when sending; you host your own policy file and can check it on the Admin console's Security Health page |
| Inbound spoofing protection | Anti-phishing policy setting Honor DMARC record policy | Spoofing and authentication safeguards in the Admin console's Gmail settings; see our Gmail security settings guide |
If you run both platforms, or are migrating between them, your SPF record must include both until the move is finished, and each platform needs its own DKIM selector. The Microsoft 365 phishing protection and Google Workspace email security hubs cover the inbound side, and Gmail security settings walks through the Admin console.
BIMI: your logo in the inbox
BIMI (Brand Indicators for Message Identification) is the reward for reaching enforcement rather than a security control in its own right. Supporting mailbox providers show your logo next to messages that pass DMARC, which gives marketing a reason to back the authentication project.
Google's requirements for BIMI in Gmail are a useful checklist:
- A DMARC policy of quarantine or reject; BIMI does not work with p=none, and Google also asks for the policy to apply to 100% of mail
- Your logo as an SVG file that meets the BIMI format, at least 96 pixels square for Gmail
- A Verified Mark Certificate (VMC) for a trademarked logo, or a Common Mark Certificate (CMC) if the logo is not trademarked; Gmail shows a checkmark for senders verified with a VMC
- A BIMI TXT record at your domain host and an HTTPS web server to host the files
Google notes that trademarking a logo can take six to twelve months, so start early if you want a VMC. Valimail Pro and IRONSCALES DMARC both include BIMI management; the certificate itself comes from a certificate authority.
NCSC guidance after Mail Check
Many UK organisations relied on the NCSC's free Mail Check service to process DMARC and TLS reports. The NCSC retired Mail Check and Web Check on 31 March 2026. It now recommends commercial external attack surface management products, publishes a buyer's guide for choosing one, and suggests subscribing to its free Check your cyber security service, which checks your email domain for anti-spoofing and email privacy settings.
The NCSC's own MTA-STS guidance now notes that Mail Check no longer processes TLS reporting. If your DMARC rua address or your TLS-RPT record still points at a Mail Check address, nobody is reading your reports. Check both records and point them at a tool that someone actually reviews.
Tools to manage email authentication
You can run authentication by hand with DNS edits and a report viewer. The hard part is the ongoing work: identifying every sender, fixing each one and noticing when something changes. These are the options we supply:
| Option | What it does | Worth knowing | Licensing | Read more |
|---|---|---|---|---|
| Valimail Core and Valimail Pro | Hosted, automated SPF (Instant SPF), DKIM and DMARC with sender discovery by service name | Pro adds BIMI, MTA-STS and continuous protection reporting | Per domain | Valimail |
| IRONSCALES DMARC and DMARC Pro | Hosted DMARC, SPF with automatic flattening, DKIM, BIMI, MTA-STS and TLS-RPT, with guided enforcement | Same console as IRONSCALES email security; the split between the two options is confirmed at quote | Per domain | IRONSCALES DMARC |
| Sophos DMARC Manager | Shows how your domains are used in outbound email and guides you towards DMARC enforcement without blocking legitimate mail | Included in Sophos Email Plus; an add-on for Sophos Email | With Sophos Email | Sophos DMARC Manager |
| Check Point DMARC Management | Hosted DMARC reporting and help moving domains to quarantine or reject | An add-on to Check Point Email Security | Add-on | DMARC Management |
| TrendAI Vision One Email and Collaboration Security | DMARC report analysis on the gateway deployment | From the Essentials tier | Per user | Trend Micro email security |
If you already use one of these vendors for inbound protection, its DMARC option keeps everything in one console. If you have many domains or many sending services, a dedicated automation platform usually gets you to reject with less manual DNS work. Our email security platforms comparison shows how these fit alongside inbound filtering, and our licensing site lists DMARC and email authentication software.
How we help
Forever Systems supplies several DMARC and email security platforms, so we can recommend the one that fits your domains rather than the one we happen to sell. A typical project:
- List every domain you own and every service that sends as each one
- Check the current SPF, DKIM, DMARC and MTA-STS records for errors and lookup limits
- Connect a reporting or hosted authentication tool and publish DMARC at p=none
- Fix SPF and DKIM for each legitimate sender, including marketing and finance platforms
- Move each domain to quarantine and then reject, and add MTA-STS and BIMI if you want them
We can also tell you when a single, simple domain needs nothing more than careful records and a free report viewer. Licence costs depend on the number of domains and the option you choose: ask us for a quote. Contact us to review your domains.
Explore Email authentication
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What are the main email authentication methods?
The three core methods are SPF, which lists the servers allowed to send for your domain; DKIM, which signs each message with a key published in your DNS; and DMARC, which checks that SPF or DKIM aligns with the visible From address and tells receivers what to do with failures. MTA-STS and BIMI build on them.
Do I need SPF, DKIM and DMARC?
Yes. Google, Yahoo and Microsoft require all three from high-volume senders, and every sender to Gmail needs at least SPF or DKIM. More importantly, only DMARC at quarantine or reject stops criminals sending mail from your exact domain, and DMARC needs SPF or DKIM to pass and align.
How do I check my email authentication?
Look up your SPF, DKIM and DMARC records with a DNS lookup tool, or open a message you sent in Gmail and choose Show original to see the authentication results in the headers. The NCSC's free Check your cyber security service also checks email anti-spoofing and privacy settings. DMARC reports show results for every sender.
In what order should I set up SPF, DKIM and DMARC?
Set up SPF and DKIM for your main mail platform first, then publish DMARC at p=none with a reporting address. Use the reports to find and fix every other sender, then move DMARC to quarantine and reject. Google suggests SPF and DKIM at least 48 hours before DMARC.
What replaced NCSC Mail Check?
Nothing from the NCSC directly. Mail Check was retired on 31 March 2026. The NCSC recommends commercial external attack surface management products and its free Check your cyber security service. For DMARC and TLS reports you now need your own tool, so check where your rua and TLS-RPT addresses point.
Is BIMI worth setting up?
BIMI is a branding benefit rather than a security control. It needs a DMARC policy of quarantine or reject, a logo in the BIMI SVG format and, for Gmail, a Verified Mark Certificate or Common Mark Certificate. It is worth doing once enforcement is in place if seeing your logo in the inbox matters to you.
Still have a question about email authentication?
Ask us and a member of our team will reply by email.