Authenticate the domain you send from
Understand SPF, DKIM and DMARC and check the records for your sending identity.
On this page
Identify the domain in your From address
Start with the domain used by your sending mailbox. Authentication concerns that identity, not the domain where you open Outreach DigLab. You will need the person who manages its DNS and the record values supplied for your sending setup. Existing records may also serve other business mail, so review the current configuration before adding or replacing anything. This guide explains the process without supplying universal record values that could break another sender.
| Item | How to use it |
|---|---|
| SPF | Identifies the servers allowed to send for the domain. Use the values for your actual sending configuration. |
| DKIM | Adds a cryptographic signature to mail so receiving systems can check it. Use the specified selector and record value. |
| DMARC | Sets the domain’s policy for authentication failures. Coordinate it with the domain administrator. |
| Custom app domain | Provides branded sign-in. It does not replace any sender authentication record. |
| Custom tracking domain | Supports campaign tracking. It is configured separately and does not authenticate the mailbox. |
Publish the records for your sending setup
Identify who manages DNS
Confirm the authoritative DNS provider for the sending domain and obtain the current authentication values for the mailbox setup.
Expected result: The administrator has the correct domain and record instructions.
Review existing records
Compare the supplied values with records already used by the business. Resolve conflicts before making a change.
Expected result: The planned update preserves the domain’s other legitimate mail services.
Add the required authentication records
For an externally managed domain, publish the SPF, DKIM and DMARC records using the supplied names, types and values.
Expected result: DNS shows the intended records under the correct domain.
Allow propagation and check the result
Wait for DNS changes to become visible, then confirm authentication using the available domain checks and a received test message.
Expected result: The current domain check and test evidence agree with the intended sending identity.
If the domain was set up through the platform
The official domain guides describe automatic SPF, DKIM and DMARC setup for domains purchased through the platform and say they are typically ready within 24 hours. That statement applies to that setup route; it does not mean an externally managed domain will receive automatic configuration. Treat the time as an expectation rather than a guaranteed deadline, and inspect the actual result before launching. This article does not instruct you to buy or move a domain.
Example authentication handoff
Sending domain: example.com
Mailbox: the approved sender on that domain
DNS administrator: designated domain owner
Records: use the current supplied SPF, DKIM and DMARC values
Existing mail services: list before changing DNS
Acceptance: record the domain check and received test outcomeThe example is a preparation note, not a DNS zone file. Copying example hostnames or guessed values into DNS would not authenticate your real mailbox.
Diagnose a failed check
Check whether the record was added to the correct DNS zone, whether the provider automatically appended the domain name, and whether the name and value match the supplied instruction. Allow propagation before assuming the change failed. If authentication passes but messages reach spam, continue with audience quality, volume and content checks. Authentication establishes part of the sender’s identity; it cannot guarantee primary-inbox placement.