Email Authentication Is Now a Requirement, Not a Suggestion

Email authentication used to be a best practice, the kind of thing security people recommended and busy businesses skipped. That era is over. The biggest mailbox providers on the planet now require it, and mail that fails the check goes to junk or gets rejected outright. If your business has never looked at SPF, DKIM, or DMARC, two things are probably true right now: criminals can send email that looks like it came from you, and some of your legitimate email is quietly not arriving.

The Rules Changed, and They Are Not Optional

In February 2024, Google and Yahoo began enforcing authentication requirements for anyone sending significant volume to their users. SPF, DKIM, and a DMARC policy became mandatory, along with one-click unsubscribe and a spam complaint ceiling. Microsoft followed in May 2025 with the same requirements for mail arriving at Outlook, Hotmail, and Live addresses. Under Microsoft’s enforcement, unauthenticated mail was routed to junk first, and the policy moved to outright rejection: the sending server gets an access denied error and the message never arrives at all.

The volume thresholds technically target bulk senders, but that misses the real point. The providers built these rules because unauthenticated mail is where fraud lives, and the same filtering machinery scores every message from every domain. A ten-person company that has never published a DMARC record is not exempt. It is just unmonitored, which is worse, because when its invoices start landing in customers’ junk folders, nobody sends a notice explaining why.

What Spoofing Actually Looks Like

Email spoofing is a criminal putting your domain in the From line of a message you never sent. To the recipient, it reads as you. The classic plays are wire fraud and invoice fraud: a message that appears to come from the owner asking accounting to pay a vendor, or a fake invoice with new banking details sent to your customers under your name. We also see the one-letter-off variant constantly, lookalike domains built to impersonate real companies in fake purchase orders.

Here is the part that stings. If your domain publishes no authentication policy, receiving mail servers have no instructions for what to do with a forgery. You have effectively left the decision to every spam filter on the internet, and the fraud gets a fighting chance. Publishing a strict policy is you telling the world’s mail servers, in a machine-readable way, to throw forgeries away.

The Three Protocols, In Plain Terms

SPF (Sender Policy Framework)

SPF is the guest list. It is a DNS record listing every server allowed to send mail for your domain: your mail provider, your invoicing platform, your CRM, your marketing tool. Mail from a server not on the list fails the check.

DKIM (DomainKeys Identified Mail)

DKIM is the tamper-evident seal. Your sending servers cryptographically sign each message, and the receiving server verifies the signature against a public key in your DNS. If the message was altered in transit or signed by someone without your key, it fails.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC is the policy that ties them together. It tells receiving servers what to do when a message fails: do nothing but report it (p=none), send it to spam (p=quarantine), or refuse it entirely (p=reject). Just as important, DMARC sends you reports showing who is sending mail as your domain, legitimate and otherwise. Most business owners who turn on reporting for the first time are surprised twice: once by the services legitimately sending as their domain that nobody remembered, and once by the forgeries.

Where Businesses Get It Wrong

The most common failure we find is not a missing SPF record. It is an incomplete one. The business set up authentication for their mail server years ago, then added an invoicing platform, a ticketing system, and a marketing tool, and never updated the records. Now their own legitimate mail fails the very checks designed to protect them, and deliverability erodes with no error message anyone sees.

The second failure is the opposite: jumping straight to p=reject without monitoring first. That is how a business blocks its own payroll notifications. The correct path is staged. Publish DMARC at p=none, watch the reports, fix every legitimate sender that is failing alignment, then tighten to quarantine, then to reject. Done in that order, nothing legitimate breaks and forgeries stop delivering.

What To Do This Week

Check whether your domain has SPF, DKIM, and DMARC records published at all. If any are missing, that is the whole to-do list right there. If they exist, the questions become whether every service that sends for you is covered, whether DMARC is aligned with at least one of the other two, and whether your policy is still sitting at p=none years after someone set it and forgot it. A monitoring-only policy that never tightens protects nothing.

This is DNS work with real consequences when it is done wrong, which is exactly why it gets skipped. It is also a one-time project with a permanent payoff: your domain becomes hard to forge and your legitimate mail stops fighting uphill against every filter it meets.

Get Your Domain Locked Down

Our technicians set up and tune email authentication for businesses across Middle Tennessee and southern Kentucky as part of our IT security services, and it is standing coverage under managed IT, where the records get updated when your tools change instead of drifting out of date. If you do not know what your domain is publishing right now, that is a five-minute check for us and a straight answer for you.

Give us a call at 931-263-8000 or let’s talk.