What is email authentication? SPF, DKIM and DMARC together
Email authentication is how receiving inboxes decide “was this really you?” It is not one record. It is SPF (who may send), DKIM (the seal), and DMARC (what to do when those fail).
What is email authentication?
Email authentication (sometimes called email auth or domain authentication) is a set of public DNS records that prove a message claiming to be from [email protected] was allowed to use that name. Without it, Gmail, Microsoft, and others treat your mail as unverified—and phishers can impersonate you more easily.
The three records (order of thinking)
SPF lists sending hosts. DKIM publishes a public key so receivers can verify the signature. DMARC sits on top: it says whether to watch, quarantine, or reject mail that fails SPF/DKIM alignment. You can check each one on CrowWake (free SPF, DKIM, and DMARC checkers) or run the full domain check. For the repeat “watch the whole stack hourly” job, see the dedicated email authentication monitoring guide.
Why it matters
Bulk-sender rules from large mailbox providers expect SPF and DKIM, and they expect DMARC to exist. Agencies feel this when a client adds a CRM or newsletter tool and mail suddenly lands in spam—or when a zone rebuild deletes _dmarc. Authentication is the product CrowWake watches first.
What “good enough” looks like
One SPF record that includes every real sender and ends with ~all or -all. At least one live DKIM selector per ESP. A DMARC record at _dmarc (start at p=none with rua, then tighten). BIMI logos come later—only after DMARC enforcement.
How to check email authentication
1) Run the free SPF checker (see also SPF monitoring). 2) Run the DKIM checker for your provider’s selector (see also DKIM monitoring). 3) Run the DMARC checker and read p= (see also DMARC monitoring). 4) Or run the free full domain check for the stack in one pass. 5) Add the domain so CrowWake crows when any of the sending records drift—see email authentication monitoring.
If CrowWake crows
Treat the failing check as the source of truth: missing SPF vs multiple SPF vs no DKIM selector vs p=none forever are different jobs. Use the matching guide (SPF / SPF monitoring, DKIM / DKIM monitoring, or DMARC / DMARC monitoring) for the paste-ready DNS shape, then re-check the stack. CrowWake monitors the records—it does not rewrite your SendGrid alignment for you.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free full domain / email authentication monitoring checker with no login.
Flock overview: Domain monitoring — DNS, email auth, SSL, and uptime as one CrowWake flock.
Deep dive: Email authentication monitoring — watch SPF + DKIM + DMARC as one flock so a silent wipe crows early.
Per-record: SPF monitoring, SPF, DKIM monitoring, DKIM, DMARC monitoring, DMARC, MX monitoring, MX — or the full domain check.