Authenticate a new domain
Publish SPF, DKIM, and DMARC for a new sending domain and verify authentication before warmup.
Objective
Authenticate a sending domain
Establish SPF, DKIM, and DMARC for a sending domain.
Starting state
Domain registered; ESP or MTA chosen; DNS access available
Prerequisites
- Sender inventory
- DNS edit rights
- ESP DKIM keys or MTA signing
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain
- Authorized senders
- DKIM selector plan
Step-by-step instructions
- Configure SPFPublish a single SPF record that covers every authorized sender.
- Configure DKIMPublish DKIM keys and enable signing for the stream.
- Configure DMARC and verifyPublish a monitoring DMARC policy, then confirm SPF/DKIM/DMARC on test mail.
Verification
- Test message shows SPF and DKIM pass with aligned DMARC
- Authoritative DNS matches the intended records
Common mistakes
- Multiple SPF records
- DKIM selector not published before signing
- Start DMARC at p=none until all senders are known?
Rollback / recovery
- Revert DNS to the prior TXT set; keep volume at zero until auth passes
Expected outcome
The new domain authenticates mail end-to-end and is ready for warmup.
When to escalate
- Production mail fails authentication after publish