Email Authentication Protocols: SPF, DKIM, DMARC, and BIMI
Email Authentication Protocols
Email authentication protocols are the standards, SPF, DKIM, DMARC, and BIMI, that verify a sender's identity and let receivers detect spoofing and phishing. They are the foundation the rest of email deliverability is built on, because a receiver that cannot tell who sent a message has no reason to trust it.
The protocols
SPF authorises sending servers. DKIM cryptographically signs messages. DMARC sets policy for failures and reports on abuse. BIMI displays a verified brand logo in the inbox, but only once DMARC is at enforcement. Together they form the modern authentication stack, covered in depth on the authentication page.
How they work together
No single protocol is sufficient alone. SPF and DKIM provide the two authentication checks, and DMARC requires at least one to pass and be aligned, then enforces policy. BIMI rewards full enforcement with brand visibility. Skipping DMARC leaves SPF and DKIM without teeth. The practical order to publish them in is set out in the DNS setup steps, and the Gmail-side walkthrough shows what a pass looks like once the records are live.
Mailbox providers apply the same stack with their own thresholds on top. Microsoft is the strictest published example, so authenticating for Outlook and Microsoft 365 is worth checking separately if a meaningful share of your recipients sit there.
How Nitrosend implements them
Nitrosend provisions DKIM, MX, and verification records automatically and grades SPF, DKIM, and DMARC against the 2026 bulk-sender requirements, so the protocol stack is handled rather than hand-configured record by record.
The protocols matter most for transactional email, where a single unauthenticated receipt or password reset going to spam costs a customer rather than a click. Anything sent through an email API still authenticates against your own domain, so the four protocols stay yours to publish even when the provider does the relaying.
Related reading
One layer up from the protocols themselves
Knowing what SPF, DKIM and DMARC each do is necessary, but running all three correctly, forever, is a maintenance job. I built Nitrosend so an AI agent owns that maintenance: it sets the records, checks alignment before every send, and flags drift before a mailbox provider does. Describe what you want sent in Claude or ChatGPT, and the protocol work happens without you touching a DNS panel again.
FAQ
What are the email authentication protocols?
SPF authorises sending servers, DKIM signs messages, DMARC sets failure policy and reporting, and BIMI displays a verified brand logo once DMARC is enforced.
Which email authentication protocol is most important?
They work together, but DMARC is the keystone: it gives SPF and DKIM enforcement and reporting. Without it, the other two have no policy behind them.