Intro
Despite the recent technological advancement that has led to the rapid surge of artificial intelligence and other alike innovations. We are still plagued by the problem that has been leaching off us for decades now: Data Infringement.
And Email Marketing suffers from it.
I know it might be surprising to you but even in 2022, there have been incidents of vicious attacks leading to complete blackouts. And it\’s not just confined to the senders, but even the customers.
Therefore, it is not a surprise ISPs have strengthened their defenses. Even if as an Email Marketer you don\’t like it, I think we should all respect their effort to safeguard people.
Nonetheless, it is more than important now to know and integrate Email Authentication systems. But before that, we have to understand what is Email Authentication.
What Is Email Authentication
Email Authentication is a name for the system implemented to validate the Email origin. You see ISPs (Inbox Service Providers) have changed the rules a lot in the last few years, it is not easy to land in the inbox directly as it was 10 years ago.
You have to put extra effort into it. I am not going to go over the details of why and how here, but you should be familiar with Sender Reputation and how it influences the IP and Domain Reputation which in turn affects the Email Deliverability, and overall ROI of a campaign.
Why Email Authentication Is Important
As iterated above, you are not going to land in the inbox of clients with a new Domain through a new IP. Maybe that would\’ve worked 10-15 years ago, it is just not the same. Today ISPs have developed intricate screening methods for Emails.
You might feel you have done the job after crafting the perfect Email Header and Body with Content that is just the best. If your Emails are going to be denied entry by ISPs, nothing would amount to anything.
NOTHING!
Therefore it is important to integrate Email Authentication methods into your business model. Regardless of what organization you choose to go for with Authentication in place you gain assurance.
For sure, even then, final decisions rest with Mail Box providers. At least you would know you have put your strongest foot ahead.
What Is SPF
SPF (Sender Policy Framework) is a protocol created to administer and published the record of IP addresses. For the protocol to work properly what happens is that SPF publishes the DNS TXT record on the public system with a list containing the validated Domain information.
Once your Email would reach the ISPs they would refer to the list submitted by SPF. If the information listed and the source of the message would match, your Email would be granted entry (it doesn\’t always happen). If not the Email would be lost in a vacuum forever, and you might never even find out why.
However, there are limitations to the protocol\’s ability. At times it can be broken or passed. If a message is passed forward there is a good chance odds of spoofing or stolen display name can increase.
Either way, it is not perfect and thus needs contrasting support – DKIM.
How Can You Implement SPF In Email Campaigns
In practice, I don\’t think you would have to create an SPF record by yourself if you are working at an organization. There are always people with a better understanding of the technical side. However, in the rare case, you are alone and there is no one to ask for help. You should be aware of the process.
A fair warning: It is not easy and requires deep knowledge of technicalities, but it is possible.
- Gather all IP addresses that are used to send Emails by your business.
- Create an SPF record.
- Access DNS Manager
- Submit the record to DNS.
- Check SPF record with SPF Checker.
\”That\’s it? It doesn\’t sound hard!\”
Well, you say that now, let me show you a little behind the scene of step two:
- Start with the SPF version, this part defines the record as SPF. An SPF record should always start with the version number v=spf1 (version 1) this tag defines the record as SPF. There used to be the second version of SPF (called: SenderID), but this was discontinued.
- After including the v=spf1 SPF version tag you should follow with all IP addresses that are authorized to send email on your behalf. For example: v=spf1 ip4:34.243.61.237 ip6:2a05:d018:e3:8c00:bb71:dea8:8b83:851e
- Next, you can include an include tag for every third-party organization that is used to send email on your behalf e.g. include:thirdpartydomain.com. This tag indicates that this particular third party is authorized to send email on behalf of your domain. You need to consult with the third party to learn which domain to use as a value for the ‘include’ statement.
- Once you have implemented all IP addresses and include tags you should end your record with an ~all or -all tag. The all tag is an important part of the SPF record as it indicates what policy should be applied when ISPs detect a server which is not listed in your SPF record. If an unauthorized server does send email on behalf of your domain, action is taken according to the policy that has been published (e.g. reject the email or mark it as spam).What is the difference between these tags? You need to instruct how strict servers need to treat the emails. The ~all tag indicates a soft fail and the -all indicates a hardfail. The all tag has the following basic markers:
-all Fail – servers that aren’t listed in the SPF record are not authorized to send email (not compliant emails will be rejected).
~all Softfail – If the email is received from a server that isn’t listed, the email will be marked as a soft fail (emails will be accepted but marked).
+all We strongly recommend not to use this option, this tag allows any server to send email from your domain.
I am going to be honest even I don\’t understand everything that is there – this script is taken from DMARC Analyzer – I guess it\’s a good thing we are marketers here.
Jeez…
SPF and DKIM
You might remember I mentioned above SPF isn\’t perfect and at times it can be broken. Well, if not it\’s okay because we are going to make SPF perfect now.
\”You can do that?\”
No. But DKIM or should I say DomainKeys Identified Mail authentication can. With both of them set up side by side, you bet your Email Authentication game is going level up.
Although just like the SPF method DKIM also relies on published records on DNS, there is a stark difference between the two. While SPF publishes the IP addresses and Domain allowed to serve the messages DKIM works on a much specific scale, with added arbitrage of a digital signature attached to each Email Header what happens is that when an ISP validates the digital mail by decrypting the message using the public key published in the DNS system.
If there wouldn\’t have been interference during transmission, the resulting value from the hash function would match the hash function received from the other end. A strong indicator to ISPs that transmission was uninterrupted. However, if the hash function would have a value different from the one received, I think it\’s fair to say you understand what would happen next.
But that\’s not important to us right now.
What we need to understand is DKIM is a better option than SPF. You should implement both to your plans and have them work side by side, yes, there is no denying the inferiority of the other.
SPF and DMARC
Remember I mentioned how it is kind of impossible to know whether your Email landed in your inbox, spam, or didn\’t even get entry at all? Well, that changed with the inception of DMARC.
It is not an authentication method.
It is no SPF.
It is no DKIM.
It is a needed piece to complete the puzzle of Email Authentication. Because it can set the rules of understanding between the ISP and sending server.
Previously that wasn\’t the case. As a person behind on sending side, you would never know the true fate of your messages. Which was not okay, you were spending money on those campaigns, it was like throwing a dart in the sky and hoping it would hit the bullseye.
So a change was needed. And the change came.
Domain Message Authentication Reporting & Conference (DMARC) is a reporting protocol and policy. It is a perfect path to hold and stop Domain Spoofing and Phishing Attacks. Just like SPF and DKIM it also makes use of the DNS System to publish a set of rules for Mail Box servers to follow.
In retrospect, it compliments SPF and DKIM quite well. If you want to have a well-oiled engine, these three are your chance to make that engine well-oiled.
Outro
Enabling email authentication is essential for protecting your brand\’s reputation as well as for ensuring that your emails are sent. This is done by lowering the likelihood that an unauthorized sender would be successful in using your domain without your knowledge or approval.
Contact your support team and ask them to check to see if you\’re already utilizing email authentication before implementing SPF, DKIM, and DMARC. They will have the essential information to assist you in configuring the right authentication for their platform if you aren\’t. You can cross that item off your list if you are.
Frequently Asked Questions – FAQ
- What is SPF email authentication?
It is a method to ensure your Email messages are validated by the ISPs and hence allowed entry to land in the inbox. SPF published the public records of the Domain allowed to send messages by the IP in a DNS system. Which in turn is used by MailBox Servers to validate the source of Email.
- What is the difference between SPF and DKIM?
In comparison, SPF is an inferior method of authentication to DKIM. It can be easily broken and passed. Although it is important to have both side by side for maximum return.
- How do I add SPF to the Email?
It is not an easy task to do it by yourself since a code has to develop, but the basic principle relies on gathering all known IP addresses, creating a TXT record, submitting the record to the DNS system, and checking the SPF file for error.
- How do you authenticate with SPF?
You don\’t authenticate, it\’s the ISPs that will use it to verify the message, and they will do it by referring to the published DNS record to check if the Domain and IP address match the listed item.
- Do I need SPF and DKIM?
Yes. In order to foolproof your Email Campaigns, it is vital to have both SPF and DKIM working side by side. You can also add the DMARC to manage the end and have a system ready for anything an ISP might throw at your way.