How do I setup domain authentication with different email and website domains?

Summary

Setting up domain authentication when your email and website domains differ primarily involves configuring SPF, DKIM, and DMARC records within your email domain's DNS settings. Focus on the email domain; the website domain is typically irrelevant. Your DKIM 'd=' tag must match the domain used in the 'From' address. Inbound mail handling must be enabled for the 'From' address domain. Properly configure SPF, DKIM, and DMARC to improve deliverability and prevent spoofing. For Mailchimp, domain verification is necessary. Implement DMARC with a gradual approach, starting with a 'p=none' policy. The goal is to establish trust and ensure emails reach the inbox, preventing them from being marked as spam. Future requirements, such as those from Google and Yahoo, may necessitate CNAME records in the same domain space as the 'From' address. Also, ensuring you have a live email account on the email domain to aid successful domain authentication implementation.

Key findings

  • DNS is for Email Domain: DNS configuration for SPF, DKIM and DMARC primarily affects the email domain, not the website domain.
  • DKIM Tag Matching: The 'd=' tag in the DKIM record must match the domain used in the 'From' address.
  • Inbound Email Handling: The sending server must be able to handle inbound mail for the domain used in the 'From' address.
  • Spoof Prevention: Correctly configured SPF, DKIM, and DMARC records help prevent email spoofing and improve deliverability.
  • Gradual DMARC Adoption: Start with 'p=none' DMARC policy and move to stricter policies (quarantine or reject) when ready.

Key considerations

  • Future CNAME Requirements: Google and Yahoo may require CNAME records in the same domain space as the 'From' address in the future.
  • Live Email Account Requirement: The domain name must have a live active email account associated to complete domain authentication process.
  • TXT Record: DKIM authentication requires the publication of a DKIM TXT record, also known as a DKIM DNS record.
  • Key Generation: Generating and validating DKIM keys is essential for successful deployment.
  • SPF Record Definition: An SPF record is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain.

What email marketers say
10Marketer opinions

Setting up domain authentication with different email and website domains involves configuring SPF, DKIM, and DMARC records primarily on the email domain's DNS settings. These records verify your email's authenticity, improve deliverability, and protect your brand's reputation. It is also recommended to start with a 'p=none' DMARC policy and progressively increase the restriction. Mailchimp requires you to verify your domain before sending. The key is to ensure that receiving mail servers trust that emails are sent from authorized sources, which is particularly important when the email and website domains are different.

Key opinions

  • SPF Record: SPF records authorize specific mail servers to send emails on behalf of your domain, preventing spoofing.
  • DKIM Signature: DKIM adds a digital signature to outgoing emails, which is verified against a public key in your DNS records.
  • DMARC Policy: DMARC builds on SPF and DKIM to instruct receiving mail servers on how to handle emails that fail authentication checks.
  • Email Domain Focus: DNS configuration is primarily important for the *email* domain, not the website domain.

Key considerations

  • Mailchimp verification: Must verify domain before sending.
  • DMARC Policy Implementation: Start with a 'p=none' DMARC policy to monitor results before enforcing stricter policies.
  • Domain reputation: Domain authentication is essential to ensure your mass emails don't land in the spam folder.
  • CNAME Records: CNAME records must be added to the domain DNS settings.
  • Prevent Spammers: Validate your SPF records to prevent spammers from using your email address.
Marketer view

Email marketer from Postmark answers that SPF records prevent spammers from using your email address. Postmark advise adding them to the top of the DNS zone file and including the records of any email providers you are using.

June 2021 - Postmark
Marketer view

Email marketer from SparkPost answers that SPF (Sender Policy Framework) records specify which mail servers are authorized to send email on behalf of your domain. Make sure your SPF record includes all the servers you use to send email, including SparkPost's.

June 2023 - SparkPost
Marketer view

Email marketer from Reddit shares that if your email domain differs from your website domain, ensure your SPF and DKIM records are set up correctly on the *email* domain's DNS. The website domain is irrelevant for email authentication.

May 2023 - Reddit
Marketer view

Email marketer from SendGrid shares that DKIM (DomainKeys Identified Mail) is an email authentication method that uses a digital signature to verify the sender's domain. To set it up, you need to generate a DKIM record in SendGrid and add it to your DNS records.

January 2024 - SendGrid
Marketer view

Email marketer from Mailchimp explains that to authenticate your domain with Mailchimp, you need to add CNAME records to your domain's DNS settings. This proves you own the domain and allows Mailchimp to send emails on your behalf.

October 2021 - Mailchimp
Marketer view

Email marketer from Cloudflare answers DKIM provides a digital signature and DMARC builds upon SPF and DKIM protocols to make it harder to spoof. Email receivers use DMARC to verify SPF and DKIM records

February 2022 - Cloudflare
Marketer view

Marketer from Email Geeks clarifies the difference between domain verification and authentication in Mailchimp. Verification requires clicking a link in an email sent to an address at that domain, while custom authentication involves CNAMEing two of Mailchimp's DKIM public keys.

July 2022 - Email Geeks
Marketer view

Email marketer from StackOverflow explains DMARC policies and recommends starting with a 'p=none' policy to monitor email authentication results without impacting deliverability. Then, gradually move to 'p=quarantine' or 'p=reject' based on your findings.

April 2022 - StackOverflow
Marketer view

Email marketer from Gmass explains domain authentication is essential to ensure your mass emails don't land in the spam folder. Validating the domain allows the receiving mail service to trust that the emails are safe.

November 2022 - Gmass
Marketer view

Email marketer from Email on Acid shares that domain authentication (SPF, DKIM, and DMARC) is crucial for improving email deliverability and protecting your brand reputation. Properly configured authentication helps prevent email spoofing and phishing attacks.

September 2021 - Email on Acid

What the experts say
10Expert opinions

When setting up domain authentication with different email and website domains, it's crucial to configure SPF, DKIM, and DMARC records within the DNS settings of the email domain. The website domain is typically not relevant. Ensure the 'd=' in your DKIM record matches the domain in the 'From' address. If using DKIM CNAMEs, these should be set up in the DNS of the domain used for sending bulk mail. Handling inbound mail for the 'From' address domain is necessary for replies and deliverability. Google and Yahoo will require CNAME records in the same domain space as the 'From' address to avoid blocks. An active email account on the domain used for authentication is also required. SPF records specify authorized mail servers, while DKIM uses signatures to verify email authenticity, and both enhance deliverability. Domain authentication is essential for establishing trust and ensuring email reaches the inbox.

Key opinions

  • Email Domain Focus: DNS settings are primarily relevant for the email domain, not the website domain.
  • DKIM Alignment: The 'd=' tag in the DKIM record should match the domain used in the 'From' address.
  • Inbound Mail Handling: The sender should be able to handle inbound mail for the domain used in the 'From' address.
  • Email Authentication: Properly configured SPF, DKIM, and DMARC improve email deliverability and prevent spoofing.
  • TXT Records: An SPF record is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain.

Key considerations

  • CNAME Requirements: Google and Yahoo will require CNAME records in the same domain as the From: address.
  • Mailbox Setup: You'll have to setup a mailbox to avoid being blocked.
  • Email Account Prerequisite: An active email account is required for the domain used for authentication.
  • DKIM setup: Generating and validating DKIM keys is key to successful deployment.
  • DKIM records: Publication of a DKIM TXT record, also known as a DKIM DNS record.
Expert view

Expert from Email Geeks explains that starting in February, Google and Yahoo will require CNAME records in the same domain space as the From: address to avoid being blocked. If using a domain in the From address, a mailbox and published CNAME records in that domain space will be necessary.

October 2022 - Email Geeks
Expert view

Expert from Spamresource.com explains that DKIM authentication requires the publication of a DKIM TXT record, also known as a DKIM DNS record. Mail servers use this record to verify the authenticity of incoming messages.

July 2022 - Spamresource.com
Expert view

Expert from Email Geeks explains that the DNS should be set up inside the email domain, as the website domain is probably not relevant for email authentication.

May 2024 - Email Geeks
Expert view

Expert from Email Geeks clarifies that if the records being added are the 'k2._domainkey…' and 'k3._domainkey…' for DKIM CNAMEs, they need to be set up in the DNS for the domain used to send bulk mail from MailChimp.

April 2024 - Email Geeks
Expert view

Expert from Word to the Wise explains domain authentication helps establish that you are who you say you are. Without that trust, it is harder to get mail delivered to the inbox.

April 2021 - Word to the Wise
Expert view

Expert from Spamresource.com explains that an SPF record is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. This can help prevent spammers from forging your email address.

April 2024 - Spamresource.com
Expert view

Expert from Email Geeks shares that the 'd=' in the DKIM record should match the domain used in the 5322.from address for email authentication.

February 2022 - Email Geeks
Expert view

Expert from Spamresource.com explains that DKIM uses cryptographic signatures to associate a domain name with an email message, thus vouching for its authenticity. Generating and validating these keys is key to successful deployment.

October 2024 - Spamresource.com
Expert view

Expert from Email Geeks confirms that an email account is required for the domain being used for email authentication, and once set up, everything else should be straightforward.

August 2023 - Email Geeks
Expert view

Expert from Email Geeks advises that the sender needs to handle inbound mail for the domain used in the 'From' address, to handle replies and ensure deliverability.

November 2023 - Email Geeks

What the documentation says
4Technical articles

Domain authentication, using SPF, DKIM, and DMARC records, is crucial for preventing spammers from sending unauthorized emails appearing to originate from your domain. SPF records, published in your DNS settings, authorize specific mail servers to send emails on your domain's behalf. DMARC builds upon SPF and DKIM, providing a policy for how receiving servers should handle emails that fail authentication checks. Proper configuration of these records ensures email deliverability and prevents spoofing.

Key findings

  • SPF Purpose: SPF records prevent spoofing and ensure email deliverability by specifying authorized mail servers.
  • SPF Location: SPF records must be published in your DNS settings and validated by receiving mail servers.
  • DMARC Function: DMARC builds on SPF and DKIM to provide a policy for handling unauthenticated emails.
  • Email Security: Domain authentication using SPF, DKIM and DMARC helps prevent spammers from forging your email address.

Key considerations

  • Configuration Importance: Proper configuration of SPF, DKIM, and DMARC records is crucial for effective domain authentication.
  • DNS Publication: Ensure all records are correctly published in your domain's DNS settings.
  • DMARC handling: Allows domain owners to specify how receiving servers should handle unauthenticated mail.
Technical article

Documentation from RFC Editor specifies how to construct the SPF record and what terms are available for use. These terms specify the authentication mechanisms available in the domain.

January 2023 - RFC Editor
Technical article

Documentation from DMARC.org explains that DMARC builds upon SPF and DKIM to provide a policy for handling emails that fail authentication checks. It allows domain owners to specify how receiving servers should handle unauthenticated mail.

October 2022 - DMARC.org
Technical article

Documentation from Microsoft Learn details how SPF records are used to prevent spoofing and ensure email deliverability. It explains that SPF records must be published in your DNS settings and validated by receiving mail servers.

March 2024 - Microsoft Learn
Technical article

Documentation from Google Workspace Admin Help explains that domain authentication helps prevent spammers from sending unauthorized messages that appear to come from your domain. They recommend setting up SPF, DKIM, and DMARC records.

March 2023 - Google Workspace Admin Help