Skip to main content

Sender Authentication: SPF, DKIM, and DMARC

Explains how mailbox providers verify that your Broadcasts genuinely come from you, and why it matters for deliverability.

In short​

Sender authentication is how a mailbox provider (Gmail, Outlook, Yahoo, and corporate mail systems) confirms that a Broadcast really came from your domain and was not spoofed. Three DNS records work together: SPF lists which servers are allowed to send for your domain, DKIM adds a cryptographic signature that proves the message was not altered in transit, and DMARC ties the two to your visible "From" address and tells providers what to do when a check fails.

Why it matters​

Authentication is one of the strongest signals providers use to decide whether your Edition lands in the inbox, the spam folder, or is rejected outright. Well-configured records protect your brand from being impersonated, build long-term sending reputation, and are now effectively required by major providers for bulk senders. When records are missing or misaligned, delivery becomes unreliable and hard to diagnose. These records are configured once in your domain's DNS, then apply to every Broadcast you send.

How it works​

Each mechanism checks a different thing:

  • SPF — The provider looks up a DNS record listing the servers permitted to send mail for your domain. If the sending server is on the list, SPF passes.
  • DKIM — Each Broadcast is signed with a private key; the matching public key lives in your DNS. The provider recomputes the signature to confirm the message is authentic and unmodified.
  • DMARC — A policy record that requires SPF or DKIM to pass and align with the domain in your From address. It also sets what happens on failure (monitor, quarantine, or reject) and can send you reporting.

Example: an Edition is sent from news@yourbrand.com. The provider checks SPF for the sending server, verifies the DKIM signature against yourbrand.com, then applies your DMARC policy. All three passing is a clear "genuine" signal. Your platform admin publishes the specific values in your DNS — (confirm the exact records and setup steps in your account).

Canonical terms: Author, Edition, Folder (Project Folder), Broadcast. See the Glossary.