Email Authentication

Authentication tells receiving mail servers that you are the legitimate owner of the domain you're sending from. Without it, your emails are far more likely to be rejected or marked as spam.

SPF

SPF (Sender Policy Framework) lists which mail servers are authorized to send email on behalf of your domain.

Add a TXT record to your domain DNS:

Type:    TXT
Host:    @  (or your domain root)
Value:   v=spf1 include:spf.keplars.com ~all
TTL:     3600

If you already have an SPF record, add include:spf.keplars.com to the existing record rather than creating a second one. DNS only supports one SPF record per hostname.

DKIM

DKIM (DomainKeys Identified Mail) cryptographically signs outgoing emails so recipients can verify the message was not tampered with in transit.

Keplars auto-signs every outgoing email: you do not need to generate keys. You only need to add the CNAME records that Keplars provides.

1. Go to Dashboard → Custom Domains → your domain → DKIM Setup
2. Copy the two CNAME records shown
3. Add them to your DNS provider

See Custom Domains for the full domain verification walkthrough.

DMARC

DMARC tells receiving servers what to do when an email fails SPF or DKIM checks. Start permissive and tighten the policy over time as you confirm all your sending sources are authenticated.

Recommended progression:

Stage 1: monitor only (no enforcement):
Type:    TXT
Host:    _dmarc
Value:   v=DMARC1; p=none; rua=mailto:[email protected]
TTL:     3600

Stage 2: quarantine suspicious messages:
Value:   v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]

Stage 3: reject unauthenticated messages:
Value:   v=DMARC1; p=reject; rua=mailto:[email protected]

Stay at each stage for at least two weeks and review the aggregate reports before advancing.

Verification Tools

After adding your DNS records, verify them with:

• MXToolbox: mxtoolbox.com/SuperTool.aspx (checks SPF, DKIM, and DMARC)
• Google Admin Toolbox: toolbox.googleapps.com/apps/checkmx (verifies MX and SPF)