Summary
For Email Service Providers (ESPs) with small customers who do not own their own domains, managing email authentication (SPF, DKIM, DMARC) presents a unique set of challenges. The core issue revolves around ensuring email deliverability and maintaining a strong sender reputation without direct control over the client's DNS. Best practices often involve leveraging ESP-owned subdomains and sophisticated DNS management techniques to provide robust authentication while isolating reputation risks.
Key findings
- Subdomain authentication: Using customer-specific subdomains of an ESP-owned domain is a primary method for providing clean SPF, DKIM, and DMARC authentication for clients who do not have their own domains. This approach also helps to isolate sending reputation, preventing one customer's poor practices from affecting others.
- DNS wildcard limitations: While wildcards in DNS can be considered, they often lead to configuration messes and records appearing where they shouldn't, making them less ideal for scalable and reliable authentication.
- Dynamic DNS record generation: A more robust solution involves having the ESP's DNS server dynamically synthesize DNS records for each customer upon request. This avoids the need to maintain large, static DNS zone files, which can be burdensome and costly.
- Authentication standards: Proper configuration of SPF, DKIM, and DMARC is critical for all senders, regardless of domain ownership, especially with new sender requirements from major mailbox providers.
Key considerations
- Scalability: ESPs must consider the scalability of their authentication solutions. Manual DNS record generation becomes unmanageable with a large customer base.
- Cost efficiency: Outsourced DNS providers billing per record can lead to prohibitively high costs when managing individual records for many small customers.
- Reputation management: The chosen authentication method should ensure that the actions of one client do not negatively impact the sending reputation of others on the platform.
- Compliance: The solution must comply with evolving email authentication standards and requirements from internet service providers (ISPs) like Google and Yahoo.
What email marketers say
Email marketers often encounter the challenge of authenticating emails for clients who don't possess their own domains. This scenario is particularly common with small businesses or those just starting out, relying heavily on their ESP's infrastructure. Marketers emphasize the importance of robust authentication to ensure emails reach the inbox and avoid blocklists, even when operating without a dedicated domain. They seek solutions that provide strong deliverability without burdening clients with complex DNS setups.
Key opinions
- Shared domains: Some marketers use mutualized (shared) domains for small or freemium customers, but acknowledge the inherent deliverability issues due to lack of SPF/DKIM alignment.
- Domain delegation: Delegating the domain to the ESP (via NS records) is a preferred method as it allows the ESP to manage all necessary authentication records centrally.
- In-platform DNS tools: ESPs offering in-platform DNS tools to automatically generate and manage SPF, DKIM, and DMARC records for their clients simplify the process greatly.
- Manual configuration: For clients who prefer or need manual setup, providing clear instructions for SPF, DKIM, and DMARC records is crucial, with some marketers avoiding CNAMEs for authentication records.
- Individual DKIM: Moving towards individual DKIM keys for each customer is seen as a best practice to enhance reputation isolation and overall deliverability.
Key considerations
- Deliverability impact: The choice of authentication method directly impacts email deliverability rates, making robust authentication essential for success.
- Customer ease of use: Solutions that minimize customer effort in setting up DNS records are highly valued, as many small businesses lack technical expertise.
- Reputation management: Preventing clients from being impacted by the sending behavior of other users on a shared IP or domain is a significant concern for marketers and ESPs alike. This highlights the importance of monitoring blocklists and maintaining good sender practices.
- Evolution of policies: Marketers must stay updated on changes to Gmail, Yahoo, and Microsoft's email authentication requirements, which increasingly demand proper authentication even for lower volume senders.
Marketer view
Marketer from Email Geeks notes that their company is transitioning away from using mutualized domains for paying customers. They explain that SPF and DKIM authentication often fail to align with mutualized domains, leading to deliverability issues. Therefore, shared domains are now primarily reserved for freemium users to test the platform.
Marketer view
Marketer from Email Geeks explains that for customers who choose to delegate their domain, their ESP utilizes the NS (Name Server) system. This method ensures that the ESP has full control over the domain's DNS records, allowing for proper configuration of all necessary authentication protocols like SPF, DKIM, and DMARC.
What the experts say
Email deliverability experts highlight that the most effective way for ESPs to manage email authentication for customers without their own domains is through the strategic use of ESP-owned subdomains. This approach ensures proper SPF, DKIM, and DMARC alignment, crucial for inbox placement. Experts also caution against common pitfalls like using DNS wildcards and emphasize the need for scalable, automated solutions for DNS record management. The goal is to provide robust authentication while protecting the overall sending reputation of the ESP.
Key opinions
- Subdomain necessity: Authenticating with customer-specific subdomains of an ESP-owned domain is considered the primary method for achieving clean SPF, DKIM, and DMARC authentication for small customers lacking their own domains.
- Reputation isolation: This subdomain approach helps in isolating reputation, meaning that potential bad actors among small customers will not negatively impact the deliverability for legitimate customers.
- DNS wildcard issues: Experts warn that while DNS wildcards might seem like a solution, they can lead to significant operational problems and unexpected record resolutions, making them unsuitable for robust authentication.
- Dynamic DNS record synthesis: A more advanced and cleaner method involves having the ESP's DNS server synthesize (generate on-the-fly) these records when requested. This eliminates the need for manual maintenance of vast DNS zone files for each customer.
- Scalable authentication framework: This dynamic record synthesis allows ESPs to integrate authentication for small customers into the same CNAME-based framework used for larger clients, ensuring consistency and scalability.
Key considerations
- Maintenance overhead: Generating and maintaining individual DNS zone files for each customer is a significant pain point and can become extremely expensive, particularly with outsourced DNS providers who charge per record.
- Deliverability impact of shared resources: ESPs must carefully consider how shared domains and IP addresses affect the deliverability and reputation of all customers, emphasizing the need for robust isolation.
- Technical implementation: Implementing a production-ready nameserver that can dynamically serve authentication records requires specialized expertise in DNS management and potentially custom backend development (e.g., PowerDNS backend).
- Policy alignment: Ensuring DMARC alignment and proper SPF/DKIM configuration for all customers, even those without their own domains, is crucial for complying with modern email standards.
Expert view
Expert from Email Geeks indicates that authenticating with customer-specific subdomains of an ESP-owned domain appears to be the most viable strategy. This approach enables the setup of SPF, DKIM, and DMARC for smaller clients who do not possess their own domains, ensuring clean authentication records and offering a degree of reputation isolation.
Expert view
Expert from Email Geeks explains that the concept of reputation isolation is crucial in this context. By segmenting customers via subdomains, ESPs can prevent the sending behavior of potentially less diligent users from negatively affecting the email deliverability and sender reputation of all other legitimate customers on the platform.
What the documentation says
Official documentation and industry standards provide the foundational principles for email authentication, which are crucial for ESPs supporting customers without their own domains. These documents emphasize the technical specifications of SPF, DKIM, and DMARC, outlining how they verify sender identity and prevent spoofing. The core message from documentation is that proper authentication is non-negotiable for email deliverability, irrespective of whether the sender controls their domain directly or relies on an ESP's delegated infrastructure. Compliance with these protocols is paramount to ensure messages are trusted by receiving mail servers.
Key findings
- SPF definition: Sender Policy Framework (SPF) is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, preventing unauthorized use of their domain.
- DKIM configuration: DomainKeys Identified Mail (DKIM) involves cryptographic signatures, requiring the configuration of DKIM keys and their publication in the DNS to verify the integrity and origin of emails.
- DMARC implementation: Domain-based Message Authentication, Reporting, and Conformance (DMARC) builds upon SPF and DKIM, allowing domain owners to specify how receiving servers should handle emails that fail authentication, as well as providing reporting mechanisms.
- Shared domain implications: Documentation often implies that using shared domains with an ESP requires careful attention to how authentication records are configured to ensure alignment and avoid deliverability issues due to misconfiguration.
Key considerations
- Compliance with new requirements: Recent updates from major mailbox providers like Gmail and Yahoo now make authentication mandatory for bulk senders, impacting even small businesses using ESPs.
- Delegated domain management: When a client delegates their domain to an ESP, the ESP assumes responsibility for managing the DNS records to ensure proper authentication, requiring robust internal systems.
- Sender authentication package (SAP): Some ESPs offer an SAP, which typically includes a dedicated IP, a private domain, and account branding (link wrapping), providing a comprehensive solution for improved authentication and branding.
- Automated setup: Documentation often encourages ESPs to provide automated or simplified processes for clients to set up domain authentication records, reducing friction and errors.
Technical article
Documentation from Mailgun states that their email authentication guide covers essential protocols like SPF, DKIM, DMARC, and BIMI. It details what major mailbox providers, including Gmail, Yahoo, and Microsoft, now require from senders to ensure messages are authenticated and delivered effectively.
Technical article
Documentation from DreamHost Blog outlines the steps for email authentication. This includes adding an SPF record to DNS, configuring DKIM keys and publishing them to DNS, and setting up a DMARC DNS record to secure authentication and improve email deliverability.
Related resources
15 resources
Related pages
Should I authenticate email with my own domain or an ESP's domain?
How do SPF, DKIM, DMARC, and dedicated IPs affect email deliverability when using a third-party ESP?
What are the best practices for email domain authentication across corporate and marketing mail?
How to set up email authentication for multiple ESPs on the same sending domain?
How to create sender email addresses for new subdomains in an ESP?
How can a franchise set up DKIM for email marketing without corporate DNS control?
Why might an email sender choose not to align their sending domain with their ESP's shared domain?
How will Google and Yahoo's new email authentication policies affect senders using shared domains and ESP authentication?
Do small email senders need their own SPF/DKIM records or can they rely on their ESP?
A simple guide to DMARC, SPF, and DKIM
