Email Authentication (SPF, DKIM, and DMARC): What You Need to Know – Merchant Central

Overview

Most major email and support systems verify whether a message actually originates from the domain it claims to represent. A domain without correctly configured SPF and DKIM may have its emails bounced, marked as spam, or dropped entirely, including emails sent to a support desk.

What Is Email Authentication?

Standard	What It Checks	If Missing or Failing
SPF (Sender Policy Framework)	Which mail servers are authorized to send on behalf of the domain	Message may be rejected or marked as spam
DKIM (DomainKeys Identified Mail)	Whether the message content was altered after sending	Message integrity cannot be verified; may be rejected or flagged
DMARC (Domain-based Message Authentication, Reporting and Conformance)	How receivers should handle messages that fail SPF or DKIM	Receiver decides independently, often by rejecting the message

All three are DNS records. Major mail providers (Gmail, Outlook, Yahoo) have applied versions of these checks by default for years, and more platforms are moving to enforce a minimum standard rather than leaving it optional.

Why This Matters

This is the standard. Major mail providers have applied SPF and DKIM checks by default. A domain missing either one is likely already experiencing delivery problems with many recipients, not only one support desk.
Not vendor-specific. A failing domain can see the same issue across multiple providers and tools, not just one.
Defaults are getting stricter. More support and ticketing systems are moving toward suspending or rejecting email from unauthenticated domains by default.
No warning. Failed messages are typically suspended or dropped silently, with no bounce-back notice.
Industry direction, not just one policy. PCI DSS v4.0.1 now recommends anti-phishing controls, including DMARC, for organizations handling cardholder data. Email authentication is becoming an expectation across the payments industry generally.
Fallback: If a domain fails these checks, email to a support desk may be suspended or may never arrive. If that happens, use the support portal's web form and ticket view instead of email until the domain issue is resolved.

The most reliable outcome is achieved by maintaining both a valid SPF record and a valid DKIM record for any domain used to send email, including to support desks.

Prerequisites

Access to the domain's DNS settings, either directly or through whoever manages the domain. This might be an internal IT team, a web developer, a website hosting company, or the domain registrar (the company the domain was purchased through).
A list of every system that sends email on behalf of the domain, since each may need to be added to the SPF record.

How It Works

Identify all domains used to send email, including any used for support correspondence.
Check current SPF/DKIM/DMARC status with a DNS lookup tool (e.g., MXToolbox, dig, nslookup).
Work with an IT team, web developer, hosting company, or domain registrar to correct or add records. See the provider table below for common setup guides.
Allow up to 48 hours for DNS propagation, then re-check.

Provider-Specific Setup Guides

Provider	SPF	DKIM	DMARC
Google	Ensure mail delivery & prevent spoofing	Set up DKIM	Set up DMARC
Outlook / Microsoft 365	Set up SPF	Set up DKIM	Set up DMARC
Yandex	SPF record	Configure DNS Settings	DMARC record check
Yahoo	How to Set Up SPF for Yahoo Mail	How to Set Up DKIM for Yahoo Mail	DMARC record check
GoDaddy	Add an SPF record	How to Add a DKIM Record in GoDaddy	DMARC record check
Bluehost	How To Setup a DNS SPF Record	What is a DKIM Record?	DMARC record check
Amazon SES	Authenticating Email with SPF	Authenticating Email with DKIM	Complying with DMARC

These are external links and may change if the provider updates their site.

Troubleshooting

Symptom	Likely Cause	Resolution
Support emails aren't getting replies or creating tickets	SPF/DKIM missing or failing	Check DNS records and correct with your IT team or domain registrar
Only some tools' emails are delivered	Not all sending systems are in the SPF record	Add the missing service to SPF
Fix applied, but check still fails	DNS hasn't propagated yet	Wait up to 48 hours, re-check

Note: Authentication failures usually happen without a bounce-back notice. Missing replies are a good early signal to check DNS records.

Key Definitions

Domain: The part of a website or email address that identifies an organization online; for example, "google.com." It usually appears after the "@" in an email address or after "www." in a website address, and is typically the same for a company's website and its email.
DNS (Domain Name System): A system that works like an address book for the internet, connecting a domain name to the technical settings that make a website, email, and other services work correctly.
DNS record: A small entry stored in a domain's DNS settings that provides specific information about that domain, such as which mail servers are allowed to send email on its behalf.
SPF (Sender Policy Framework): A DNS record listing which mail servers are allowed to send email for a domain.
DKIM (DomainKeys Identified Mail): A digital signature added to outgoing email that proves its content hasn't been changed in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance): A DNS record that tells receiving mail servers what to do if a message fails SPF or DKIM.
Domain administrator / IT team: The person or company responsible for managing a domain's technical settings. This could be an internal IT staff member, a web developer, a website hosting company, or the domain registrar.
Domain registrar: The company a domain was purchased through (for example, GoDaddy, Namecheap, or Google Domains). If it's unclear who manages a domain's settings, the registrar is a good place to start.