Email Deliverability: Authentication Beyond SPF

By Ingrid Solberg · August 2, 2026 · Email

SPF alone stopped being enough years ago. A message that passes SPF can still fail alignment, and mailbox providers have grown far more interested in DKIM signatures and DMARC policy than in the envelope any single check describes.

DKIM is the workhorse because it survives forwarding: the signature travels with the message rather than with the connection. DMARC then ties the visible From domain to whichever identifier authenticated, and its reporting alone justifies deployment - the aggregate reports are the closest thing email has to an observability stack.

Start at p=none, read the reports for a month, fix the legitimate senders that fail alignment, and only then move to quarantine. Skipping the quiet phase is how marketing ends up in spam and nobody knows why.