Email authentication guides
Fixes for email authentication errors, setup for each email provider and DNS host, and how SPF, DKIM and DMARC work.
Email errors
What an email authentication error or warning means, and how to fix it with your provider.
-
550 5.7.26: read which authentication check failed, then fix it
Gmail uses 550 5.7.26 for three different authentication failures. Read the text after the code, then fix SPF, DKIM or DMARC alignment for that sender.
-
DKIM fail: what the reason in the header means and how to fix it
dkim=fail means the receiver's DKIM verification failed. Read the reason in brackets, then fix the message path, the DNS record or the key that does not match.
-
550 5.4.1 Recipient address rejected: Access denied: what it means and who can fix it
This bounce comes from the recipient's Exchange Online tenant, not your SPF or DKIM. What 550 5.4.1 means, who can fix it, and what to send their admin.
-
Reverse DNS does not match SMTP banner: what the warning means and how to fix it
Your mail server greets with a hostname that does not match the PTR record of its IP. What is compared, who fixes each side, and the dig commands to check.
-
550 5.7.1: what the bounce means and how to fix it
What a 550 5.7.1 bounce means, how to read the text after the code from Gmail or Microsoft 365, and whether you or the recipient's admin must fix it.
-
SPF record with a hard fail: what -all means and when to use it
What an SPF hard fail (-all) and soft fail (~all) do, what Google and Microsoft each recommend, and how DMARC changes the choice.
-
SPF too many DNS lookups: what counts toward the limit and how to fix it
What SPF too many DNS lookups (PermError) means, which terms count toward the 10-lookup limit, what common senders cost, and how to fix it.
-
DMARC fail: what it means and how to fix it
What dmarc=fail means, how to read it in the Authentication-Results header, and how to fix SPF and DKIM alignment for services and forwarded mail.
-
DMARC policy not enabled
What the DMARC policy not enabled warning means, whether p=none affects delivery, and the safe order to move to quarantine or reject.
-
No DMARC record found
Fix No DMARC record found: add the right DNS TXT record, check subdomain inheritance, and troubleshoot a record that still does not appear.
Provider setup
SPF, DKIM and DMARC setup for each sending service and DNS host, checked against live DNS.
-
Klaviyo SPF, DKIM and DMARC: set up and verify a branded sending domain
Which DNS records a Klaviyo branded sending domain needs, why you add no SPF include of your own, where DMARC goes, and how to verify it.
-
Mailchimp SPF, DKIM and DMARC: the records domain authentication needs
Which DNS records Mailchimp domain authentication asks for (two DKIM CNAMEs and a DMARC TXT, no SPF record), how to add them, and how Transactional differs.
-
Cloudflare DMARC: publish the record and understand the reports
Where the DMARC record lives on Cloudflare DNS, what DMARC Management adds to it, how to keep your reporting address, and why published is not passing.
-
Microsoft 365 SPF, DKIM and DMARC: configure and verify your domain
The SPF include, the two DKIM CNAMEs your tenant generates and the DMARC record for a Microsoft 365 custom domain, and how to confirm mail is signed.
-
Brevo SPF, DKIM and DMARC: authenticate your domain with the records Brevo gives you
The DNS records Brevo asks for to authenticate a sending domain (Brevo code, DKIM and DMARC), when SPF matters, how to merge spf.brevo.com, and how to check.
-
Postfix DKIM with OpenDKIM: sign outgoing mail and publish the key
Sign Postfix mail with OpenDKIM: generate the key, publish the TXT record, configure OpenDKIM, connect the milter, and test the signature.
-
SendGrid SPF, DKIM and DMARC: the CNAME records domain authentication asks for
What SendGrid domain authentication adds to DNS, why the SPF include sits on the return-path subdomain, automated vs manual security, and the DMARC record.
-
Shopify SPF, DKIM and DMARC: which records your store email needs
Shopify authenticates your sender email with CNAME records and requires a DMARC record. What to add, why no SPF TXT record is needed, and what the rewrites mean
-
Zoho Mail SPF, DKIM and DMARC: the records to add and where Zoho shows them
The SPF value Zoho Mail requires, where the DKIM selector and key come from in the Admin Console, the DMARC record to publish, and how to verify all three.
-
Google Workspace SPF, DKIM and DMARC: the three records to add
The SPF, DKIM and DMARC records a Google Workspace domain publishes, where each value comes from in the Admin console, and how to check them.
Reference
How SPF, DKIM, DMARC and the related DNS records work.
-
BIMI record: syntax, requirements and which inboxes show the logo
What a BIMI record looks like, what each tag means, the DMARC and logo rules behind it, and which inboxes show the logo.
-
DMARC reports explained: read an aggregate report line by line, RUA vs RUF, and what to do next
Google's example DMARC aggregate report with its main elements explained, why failure reports rarely arrive, and the four questions to ask every report.
-
DMARC for MSPs: running DMARC monitoring for client domains, and what the platforms offer
The per-client DMARC routine, DemiSignal affiliate and agency-partner routes, what four other platforms offer MSPs, and an onboarding sequence.
-
DMARC pricing: what is free, what vendors charge, and what moves you up a tier
Published entry prices from eight DMARC vendors side by side, the four meters that move you up a tier, and each vendor one by one.
-
DMARC providers compared: what a DMARC service does, what each one costs, and how to choose
What a DMARC provider does, the published entry prices of eight vendors side by side, the counting rules behind the tiers, and how to choose.
-
DMARC record tags and examples: every tag, what it does, and which ones RFC 9989 retired
Every DMARC tag with its values and defaults, example records for monitoring, quarantine and reject, strict vs relaxed alignment, and what RFC 9989 changed.
-
Free DMARC monitoring: what you can get without paying, and where free stops
The free tiers at Postmark, dmarcian, Sendmarc and Valimail with their stated limits, what a free DNS check shows, and what DemiSignal Starter adds.
-
MXToolbox alternative for SPF, DKIM and DMARC: what DemiSignal does, and what it does not
What MXToolbox's lookups, Domain Health and Delivery Center do in its own words, and where DemiSignal's free check and paid monitoring replace them or do not.
-
SPF macros: the syntax, every macro letter, and worked examples from RFC 7208
What SPF macros such as %{i} and %{d} expand to, transformers and delimiters, where macros are allowed, RFC 7208 worked examples, and the lookup limit.
-
RFC 9989 vs RFC 7489: what changed in DMARC
RFC 9989 obsoletes RFC 7489. What changed in DMARC: removed and new tags, the DNS Tree Walk, reporting in RFC 9990 and 9991, and what to check.
Research
Email authentication adoption, measured from public DNS.
-
DMARC adoption in the Tranco top 10,000: October 2026
We scanned the Tranco top 10,000 for DMARC: 60.4% of mail domains enforce, 22.0% sit at p=none, and 30.9% of p=none domains get no reports.
-
DMARC in US public school districts, by state: October 2026
A DNS scan of US public school districts on 14 October 2026: 40.3% of districts with mail enforce DMARC, and 59.7% do not. Results by state.