Authenticate a new domain
Publish SPF, DKIM, and DMARC for a new sending domain and verify authentication before warmup.
- Difficulty:
- Intermediate
- Prerequisites:
- Sender inventory, DNS edit rights, ESP DKIM keys or MTA signing
- Last updated:
- 2026-07-15
- Author:
- empire
Objective
Authenticate a sending domain
Establish SPF, DKIM, and DMARC for a sending domain.
Starting state
Domain registered; ESP or MTA chosen; DNS access available
Prerequisites
- Sender inventory
- DNS edit rights
- ESP DKIM keys or MTA signing
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain
- Authorized senders
- DKIM selector plan
Step-by-step instructions
- Configure SPFPublish a single SPF record that covers every authorized sender.
- Configure DKIMPublish DKIM keys and enable signing for the stream.
- Configure DMARC and verifyPublish a monitoring DMARC policy, then confirm SPF/DKIM/DMARC on test mail.
Verification
- Test message shows SPF and DKIM pass with aligned DMARC
- Authoritative DNS matches the intended records
Common mistakes
- Multiple SPF records
- DKIM selector not published before signing
- Start DMARC at p=none until all senders are known?
Rollback / recovery
- Revert DNS to the prior TXT set; keep volume at zero until auth passes
Expected outcome
The new domain authenticates mail end-to-end and is ready for warmup.
When to escalate
- Production mail fails authentication after publish
Related Learn Articles
- AuthenticationIdentity signals for email: SPF, DKIM, DMARC, and related controls.
- SPFSender Policy Framework — authorizes hosts that may send for a domain.
- DKIMDomainKeys Identified Mail — cryptographic signatures for message integrity.
- DMARCDomain-based Message Authentication, Reporting, and Conformance.
Related Toolbox Tools
- digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
- MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
- Mail-TesterSend-a-message spam and authentication scoring for pre-send QA.
- Kitterman SPF validatorClassic web SPF policy evaluator used by operators for syntax checks.
- DKIMCoreDKIM key and signature oriented validation utilities.
- dmarcian inspectorsDMARC-focused inspectors and educational tooling from dmarcian.
- EasyDMARC free toolsFree DMARC/SPF/DKIM lookup and analysis utilities from EasyDMARC.
- PowerDMARC free analyzersFree authentication analyzers from PowerDMARC for SPF, DKIM, and DMARC.
- LearnDMARCInteractive DMARC learning and inspection helper for operators new to enforcement.
- URIports toolsDMARC and related reporting tools for operators collecting aggregate feedback.