Make Your Email Pass Authentication

✓ How To Do It

1. List every service that sends mail as your domain. That means your mailbox, your website forms, your invoice tool and any marketing platform.
2. Add an SPF record in DNS. It is one TXT record that lists who may send for your domain. A domain should have exactly one SPF record, so merge services into it.
3. Turn on DKIM in each sending service. The service gives you a record to paste into DNS, and it signs each message so the receiver can check it.
4. Add a DMARC record at the name _dmarc on your domain. Start with a policy of none and an address that receives reports. This watches without blocking anything.
5. Send a test email from each service to a Gmail address you own. Open the message, choose Show original and look for SPF, DKIM and DMARC all saying pass.
6. Check that the From domain matches the SPF or DKIM domain. DMARC needs that match, which is called alignment.
7. If a service fails, fix its records or move it to one that passes. Do not keep sending from a failing source.
8. Read the DMARC reports for two weeks. Look for senders you did not know about and fix them.
9. When everything passes, tighten the policy step by step, first to quarantine and later to reject. Stop at any step where real mail starts failing.