Question 1

What is email authentication?

Accepted Answer

Email authentication is a set of DNS-based protocols — SPF, DKIM, and DMARC — that verify an email was sent by an authorized sender. These protocols work together to prove that a message genuinely originates from the domain shown in the From address, preventing attackers from impersonating your brand. Without email authentication, anyone can send messages that appear to come from your domain, putting your customers and reputation at risk.

Question 2

What is DMARC?

Accepted Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS protocol that builds on SPF and DKIM to give domain owners control over how inbox providers handle unauthenticated email. A DMARC record is published as a DNS TXT entry at _dmarc.yourdomain.com and specifies a policy (none, quarantine, or reject), alignment requirements, and reporting addresses. When an email fails both SPF and DKIM alignment checks, the receiving server follows the DMARC policy to decide whether to deliver, quarantine, or reject the message.

Question 3

What is SPF?

Accepted Answer

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email, it checks the sending server's IP address against the SPF record published in DNS. If the IP is listed, the SPF check passes. SPF helps prevent unauthorized servers from sending email as your domain, but it only validates the envelope sender (Return-Path), not the From header that recipients see.

Question 4

What is DKIM?

Accepted Answer

DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. The sending server signs parts of the email header and body using a private key, and the corresponding public key is published as a DNS TXT record. Receiving servers retrieve the public key and verify the signature to confirm the message was not altered in transit and was authorized by the signing domain. DKIM provides integrity verification that SPF alone cannot offer.

Question 5

What is the difference between SPF, DKIM, and DMARC?

Accepted Answer

SPF authorizes which servers can send email for your domain by listing approved IP addresses in DNS. DKIM signs each message with a cryptographic key so recipients can verify it was not tampered with. DMARC ties them together by requiring that at least one of SPF or DKIM passes and aligns with the From domain, then specifies a policy for what to do with failures. SPF answers "who is allowed to send," DKIM answers "was this message altered," and DMARC answers "what should happen when checks fail." All three are needed for complete protection.

Question 6

Do I need all three protocols?

Accepted Answer

Yes. While each protocol works independently, they complement each other and all three are necessary for comprehensive email authentication. SPF alone does not protect against header spoofing. DKIM alone does not tell receivers what to do with unsigned messages. DMARC alone has nothing to enforce without SPF or DKIM results to evaluate. Major inbox providers including Google, Yahoo, and Microsoft now require all three for bulk senders, and best practice is to deploy all three regardless of sending volume.

Question 7

What is email spoofing?

Accepted Answer

Email spoofing is when someone sends an email that appears to come from your domain without your authorization. The SMTP protocol does not natively verify sender identity, so an attacker can set any address in the From field. Spoofed emails are commonly used in phishing attacks, business email compromise (BEC), and brand impersonation. Properly configured SPF, DKIM, and DMARC records prevent spoofing by allowing receiving servers to detect and block unauthorized messages before they reach the inbox.

Question 8

What is a DMARC policy?

Accepted Answer

A DMARC policy tells inbox providers what to do with emails that fail authentication checks. There are three policy levels: p=none monitors and reports without affecting delivery, p=quarantine sends failing messages to the spam folder, and p=reject instructs the receiving server to block failing messages entirely. Domain owners typically start at p=none to gather data, move to p=quarantine once legitimate senders are identified and aligned, and graduate to p=reject for full protection against spoofing.

Question 9

Is DMARC required?

Accepted Answer

Yes. Since February 2024, Google and Yahoo require DMARC for all bulk senders (those sending more than 5,000 messages per day). Microsoft Outlook followed with similar requirements in May 2025. Even for lower-volume senders, DMARC is strongly recommended as a baseline security measure. Federal agencies in the United States have been required to implement DMARC at p=reject since 2018 under CISA BOD 18-01. The trend across the industry is toward mandatory DMARC for all senders.

Question 10

What are Google's email authentication requirements?

Accepted Answer

Google requires SPF or DKIM for all senders sending to Gmail addresses. For bulk senders (5,000 or more messages per day to Gmail), Google requires all three: SPF, DKIM, and DMARC with at least a p=none policy. Bulk senders must also ensure SPF and DKIM alignment with the From header domain, include a one-click unsubscribe header in marketing email, maintain a spam complaint rate below 0.3%, and use a TLS connection for transmitting email. Non-compliant senders may see messages deferred, sent to spam, or rejected.

Question 11

What are Yahoo's email requirements?

Accepted Answer

Yahoo's email authentication requirements are nearly identical to Google's. All senders must authenticate with SPF or DKIM. Bulk senders (5,000+ messages per day) must implement SPF, DKIM, and DMARC with at least p=none, maintain a low spam complaint rate, and include a one-click unsubscribe mechanism in commercial email. Yahoo enforces these requirements across all Yahoo Mail and AOL Mail domains. Enforcement began in February 2024 alongside Google's requirements.

Question 12

What does Microsoft require?

Accepted Answer

As of May 2025, Microsoft Outlook requires DMARC, SPF, and DKIM for high-volume senders (more than 5,000 messages per day) sending to Outlook.com, Hotmail.com, and Live.com addresses. Microsoft recommends a DMARC policy of at least p=quarantine and requires that both SPF and DKIM align with the From domain. Non-compliant messages are initially routed to the Junk folder, with full rejection planned for later enforcement phases. Microsoft also encourages ARC (Authenticated Received Chain) headers for messages that pass through intermediaries.

Question 13

What is a compliance score?

Accepted Answer

A compliance score is a 0-100 rating that measures how well your email authentication is configured. The score evaluates the presence and correctness of your SPF, DKIM, and DMARC records, the strength of your DMARC policy, alignment settings, reporting configuration, and adherence to best practices. A score of 100 indicates fully optimized authentication with a p=reject DMARC policy and proper alignment. Inbox Insignia calculates this score automatically during each scan and tracks changes over time so you can measure improvement.

Question 14

What regulations require email authentication?

Accepted Answer

CISA BOD 18-01 requires all US federal agencies to implement DMARC at p=reject. Various GDPR guidance documents from EU data protection authorities recommend email authentication as a technical measure to protect personal data in transit. PCI-DSS best practices include email authentication as part of anti-phishing controls. Industry-specific standards such as HIPAA (healthcare) and NIST 800-177 (US government) reference email authentication. Beyond regulation, cyber insurance providers increasingly require DMARC as a condition of coverage.

Question 15

What happens if I don't have DMARC?

Accepted Answer

Without DMARC, your emails may be rejected or sent to spam by major inbox providers that now require it for bulk senders. Your domain can also be freely spoofed for phishing attacks, since receiving servers have no policy telling them to block unauthenticated messages claiming to be from you. You lose visibility into who is sending email as your domain because DMARC aggregate reports are only generated when a DMARC record exists. The lack of DMARC also signals to inbox providers that your domain may be less trustworthy, potentially harming overall deliverability.

Question 16

What is Inbox Insignia?

Accepted Answer

Inbox Insignia is an email authentication compliance monitoring platform that helps organizations deploy, monitor, and maintain SPF, DKIM, and DMARC. The platform runs scheduled DNS scans, produces a 0-100 compliance score, detects configuration drift, ingests DMARC aggregate reports, and sends alerts when issues are found. Starter includes weekly posture checks, Growth includes daily posture checks with hourly drift detection, and Agency and above include daily posture checks with 15-minute drift detection. Inbox Insignia is designed for IT teams, MSPs, and agencies managing email authentication across one or many domains, with plans ranging from a 3-domain Starter tier to sales-assisted Agency Plus, Enterprise, and Enterprise Plus expansion tiers for 250, 500, and 1,000 domains. Starter and Growth include a 14-day free trial.

Question 17

How does Inbox Insignia work?

Accepted Answer

Inbox Insignia scans your domain's DNS records on a recurring schedule to validate your SPF, DKIM, and DMARC configuration. Starter runs weekly posture checks, Growth runs daily checks with hourly drift detection between scans, and Agency and above keep daily checks while reducing drift detection to every 15 minutes. Each scan produces a 0-100 compliance score with specific findings and actionable recommendations. The platform tracks your score over time, maintains an evidence timeline for audit purposes, and alerts you when a record changes unexpectedly. On higher plans, Inbox Insignia also ingests your DMARC aggregate reports to show which IP addresses are sending email as your domain and whether those messages pass authentication.

Question 18

Is there a free trial?

Accepted Answer

Yes. Starter and Growth include a 14-day free trial with no credit card required. During the trial you can add domains, run scans, view compliance scores, and explore the dashboard. At the end of the trial, choose the plan that fits your needs or cancel with no obligation.

Question 19

What's included in paid plans?

Accepted Answer

Starter ($39/mo) includes 3 domains with weekly posture checks, compliance scoring, basic DMARC insights, and email alerts. Growth ($129/mo) includes 25 domains with daily posture checks, hourly drift detection, full DMARC aggregate ingestion, Slack/webhook alerts, and RBAC. Agency ($399/mo) includes 100 domains with daily posture checks, 15-minute drift detection, white-label, full API access, multi-tenant management, audit-ready exports, and priority support. Agency Plus, Enterprise, and Enterprise Plus stay visible on the pricing page and upgrade surfaces with sales-assisted checkout for 250, 500, and 1,000 monitored domains. Deferred enterprise-only capabilities are not sold until they ship. Starter and Growth include a 14-day free trial.

Question 20

How do I get started?

Accepted Answer

Create your account, add your domain, and verify ownership via a DNS TXT record. Your first compliance scan runs automatically as soon as the domain is verified. You will receive a compliance score, a list of findings, and specific recommendations within minutes. Starter and Growth include a 14-day free trial with no credit card required.

Question 21

What is drift detection?

Accepted Answer

Drift detection monitors your DNS records for unexpected changes and alerts you immediately when a modification is detected. DNS records can change due to accidental edits, unauthorized access, domain registrar issues, or third-party service updates. Without drift detection, a broken SPF record or weakened DMARC policy could go unnoticed for days or weeks, degrading your email deliverability and security posture. Growth includes hourly drift detection, while Agency and above reduce that cadence to 15 minutes.

Question 22

What alert channels are supported?

Accepted Answer

Email alerts are available on all plans, including during the free trial. Slack notifications and webhook integrations are available on Growth and above. Webhooks allow you to integrate Inbox Insignia alerts with any system that accepts HTTP callbacks, including PagerDuty, Microsoft Teams (via connector), and custom internal tools. All alert channels can be configured per workspace in the dashboard settings.

Question 23

Do you offer an API?

Accepted Answer

Yes. REST API access is included on the Agency plan and available as an add-on for Growth. The API allows you to programmatically manage domains, trigger scans, retrieve compliance scores, and pull scan results into your own dashboards or reporting tools. API keys are generated in the dashboard and scoped to individual workspaces for security. Full API documentation is available to authenticated users.

Question 24

How do I check my DMARC record?

Accepted Answer

Use the free DMARC checker tool to instantly validate your domain's DMARC record. Enter your domain and the tool will retrieve your _dmarc TXT record, analyze the policy, alignment settings, and reporting addresses, and provide specific recommendations for improvement. No account required.

Question 25

How do I check my SPF record?

Accepted Answer

Use the free SPF checker tool to validate your domain's SPF record. The tool retrieves your SPF TXT record, counts DNS lookups against the 10-lookup limit, identifies syntax errors, and flags common misconfigurations like missing include statements or overly permissive mechanisms. No account required.

Question 26

What is the SPF 10 DNS lookup limit?

Accepted Answer

The SPF specification (RFC 7208) limits SPF record evaluation to a maximum of 10 DNS lookups. Each "include," "a," "mx," "redirect," and "exists" mechanism counts as one lookup. If your SPF record exceeds 10 lookups, receiving servers will return a PermError and the SPF check fails. This commonly happens when organizations use many third-party email services (marketing platforms, CRMs, helpdesks) that each require an include statement. Solutions include consolidating includes, using SPF flattening services, or removing unused senders.

Question 27

What is DMARC alignment?

Accepted Answer

DMARC alignment is when the domain used in SPF or DKIM matches the domain in the email's visible From header. SPF alignment compares the Return-Path domain to the From domain. DKIM alignment compares the DKIM signing domain (d= tag) to the From domain. DMARC requires at least one of these to align for the message to pass. Alignment can be "strict" (exact domain match) or "relaxed" (organizational domain match, allowing subdomains). Relaxed alignment is the default and is sufficient for most organizations.

Question 28

What are DMARC aggregate reports (rua)?

Accepted Answer

DMARC aggregate reports are XML files sent daily by inbox providers to the address specified in your DMARC record's rua tag. Each report summarizes authentication results for all emails received from your domain during a 24-hour period, including the sending IP addresses, the number of messages, and whether each message passed or failed SPF, DKIM, and DMARC. These reports are essential for identifying all legitimate senders, detecting unauthorized use of your domain, and safely progressing your DMARC policy from p=none to p=reject.

Question 29

How often are scans run?

Accepted Answer

DNS compliance scans run weekly on Starter and daily on Growth and above, including during the free trial. Growth includes hourly drift detection, and Agency and above reduce drift detection to every 15 minutes between full daily posture checks. You can also trigger a manual scan at any time from the dashboard. Scan results are stored historically so you can track compliance trends and generate audit-ready evidence over time.

Question 30

Can I monitor subdomains?

Accepted Answer

Yes. DMARC supports subdomain policies via the sp= tag in the organizational domain's DMARC record, and you can add individual subdomains to Inbox Insignia for dedicated monitoring. Each subdomain counts as a separate domain toward your plan's domain limit. Monitoring subdomains is important because attackers often target unprotected subdomains (e.g., mail.yourdomain.com or marketing.yourdomain.com) that lack their own DMARC records and inherit the parent domain's policy.

Frequently Asked Questions

Email Authentication Basics

Compliance & Requirements

Using Inbox Insignia

Technical Questions

Frequently Asked Questions

Email Authentication Basics

Compliance & Requirements

Using Inbox Insignia

Technical Questions