Summary
Setting up email authentication for a single sending domain across multiple Email Service Providers (ESPs) is a common challenge for many organizations, especially startups. While seemingly straightforward, it involves careful configuration of SPF, DKIM, and DMARC records to ensure deliverability and maintain sender reputation.
Key findings
- Complexity: Authenticating a single domain across several ESPs introduces significant complexity, particularly for SPF records due to their DNS lookup limits and for DKIM, which requires unique selectors per sender.
- DMARC visibility: Implementing DMARC, even with a policy of p=none, is crucial for gaining insights into all sending sources using your domain, helping identify both authorized and unauthorized senders.
- Authentication vs. deliverability: While proper email authentication (SPF, DKIM, DMARC) is fundamental, it does not unilaterally solve inbox placement issues. Other factors, such as sending practices, content quality, and recipient engagement, significantly influence deliverability.
- Subdomain benefits: Using subdomains for different ESPs or email types (e.g., transactional, marketing) can help isolate reputation and simplify authentication management, preventing one sending stream from negatively impacting others.
Key considerations
- Assess ESP capabilities: Before implementing changes, confirm each ESP's specific support for custom SPF, DKIM, and DMARC configurations. Some ESPs handle authentication differently than others.
- Monitor DMARC reports: Regularly monitor DMARC aggregate reports to identify any authentication failures or unauthorized email activity originating from your domain.
- DNS lookup limits: Be cautious of the 10 DNS lookup limit for SPF records. Exceeding this limit will cause SPF validation to fail.
- Strategic consolidation: Evaluate whether consolidating ESPs could simplify your email infrastructure and improve overall deliverability management.
What email marketers say
Email marketers often find themselves managing a patchwork of ESPs, each adopted for different team needs or functionalities. This distributed sending environment can lead to confusion regarding authentication, with many assuming that implementing SPF, DKIM, and DMARC will be a magic bullet for all deliverability woes.
Key opinions
- Deliverability assumption: Many marketers initially believe that custom email authentication is the primary solution for poor inbox placement issues, even when other factors are at play.
- Organic growth of ESPs: Startups often acquire multiple ESPs over time without a centralized strategy, leading to fragmented sending practices and potential deliverability challenges.
- Reputation concerns: Marketers are concerned about potential negative impacts on their sender reputation if they switch from an ESP's default authentication to custom domain authentication without proper planning.
- Need for oversight: There's a recognized need for better internal structure and alignment when multiple teams are using different ESPs under the same sending domain.
Key considerations
- Current inbox placement: It's vital to assess the current inbox placement before making any authentication changes. If deliverability is already good, changes should be approached cautiously to avoid disrupting existing success.
- Strategic conversations: Engage in internal discussions about the necessity of using numerous ESPs, potential overlaps, and opportunities for consolidation to streamline operations.
- Data consolidation: Consider using data integration tools to simplify the process of migrating data and consolidating email sending platforms, if that is the long-term strategy.
- Beyond authentication: Remember that authentication is one piece of the puzzle. Other best practices, such as list hygiene, content quality, and sending frequency, also play a significant role in deliverability.
Marketer view
Email marketer from Email Geeks suggests that their company is currently using five different ESPs, all under the same sending domain, and is facing challenges with email authentication. They are looking for advice on setting up SPF and DKIM for all these senders, noting that custom authentication might help with deliverability issues they are experiencing.
Marketer view
Marketer from Kickbox Blog observes that sharing a sending domain between ESPs can allow for reputation transfer. This means a good reputation built on one platform can potentially benefit sending from another, which is a key advantage for companies looking to switch or expand their email services.
What the experts say
Email deliverability experts offer a more granular perspective on managing authentication for multiple ESPs. Their advice often delves into the intricacies of DNS records, the limitations of standard protocols like SPF, and the strategic importance of DMARC for comprehensive domain oversight. They also emphasize that technical configurations are only one aspect; underlying sending practices significantly impact inbox placement.
Key opinions
- DKIM selector necessity: Experts recommend setting up different DKIM selectors for each ESP to avoid sharing private keys and maintain distinct authentication paths.
- SPF DNS lookup limit: A critical point of concern is the 10 DNS lookup limit for SPF records, which can be easily exceeded when aggregating multiple ESPs' include mechanisms.
- DMARC enforcement challenges: Achieving DMARC enforcement (e.g., p=quarantine or p=reject) is more difficult with multiple ESPs due to potential DMARC alignment issues.
- Root cause analysis: Experts often point out that deliverability issues, especially for startups with many ESPs, might stem from overly aggressive sales practices or poor permission handling rather than just authentication.
Key considerations
- Comprehensive ESP audit: Conduct a thorough audit of each ESP's platform to understand their specific authentication methods and limitations, especially concerning SPF, DKIM, and DMARC.
- DMARC as a diagnostic tool: Start with a DMARC policy of p=none to gain visibility into all email flows from your domain, which is essential for identifying all sending sources and authentication gaps.
- Consolidation strategy: Seriously consider consolidating ESPs if feasible. Reducing the number of sending platforms can significantly simplify authentication, reputation management, and overall email operations.
- Focus on core deliverability: Address underlying deliverability issues such as list hygiene, consent, and engagement. Authentication is a prerequisite, but these factors drive long-term inbox success.
Expert view
Expert from Email Geeks suggests that you could set up multiple domain key selectors for each group or ESP. This is necessary because sharing private keys between different platforms is not advisable, ensuring each sender has its unique DKIM authentication.
Expert view
Expert from SpamResource highlights that the core of good email sending practice is rooted in permission. They advise that even with perfect authentication, if a sender is mailing to recipients who have not opted in or are disengaged, deliverability will suffer.
What the documentation says
Official documentation and industry standards provide the foundational rules for email authentication. These resources outline how SPF, DKIM, and DMARC should be configured at the DNS level. When dealing with multiple ESPs, the key is understanding how each protocol accommodates multiple authorized senders while adhering to strict technical limitations.
Key findings
- Standard protocols: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are the established internet standards for email authentication.
- SPF record aggregation: To authorize multiple ESPs, a single SPF TXT record for a domain typically needs to include all authorized sending mechanisms (e.g., include:esp1.com include:esp2.com). This must stay within the 10 DNS lookup limit.
- DKIM setup: Each ESP will provide unique DKIM CNAME records or public keys to be published in your DNS. These typically use distinct selectors (e.g., s1._domainkey.yourdomain.com, mta._domainkey.yourdomain.com) for each service.
- DMARC policy application: A single DMARC record applies to the entire organizational domain and its subdomains, dictating how receiving mail servers should handle emails that fail SPF or DKIM authentication.
Key considerations
- DNS record management: Carefully manage DNS records to avoid conflicts or exceeding limits. This includes ensuring correct TXT records for SPF and proper CNAMEs for DKIM.
- DMARC alignment: Understand DMARC alignment requirements. For a DMARC pass, the domain in the 'From:' header must align with either the SPF domain or the DKIM signing domain. Each ESP must ensure this alignment.
- Gradual DMARC rollout: Documentation generally advises starting DMARC with a p=none policy to collect reports and understand your email ecosystem before moving to more restrictive policies like p=quarantine or p=reject.
- Subdomain recommendation: Many official guides suggest using subdomains for different email streams or ESPs to compartmentalize sender reputation and simplify authentication records.
Technical article
Documentation from Mailgun explains that email authentication is fundamental for verifying sender identity. It outlines the role of SPF, DKIM, and DMARC as critical methods for separating legitimate emails from forged ones, emphasizing their importance for trust.
Technical article
HighLevel Support Portal documentation details the steps for setting up a dedicated sending domain, which typically involves navigating to email services settings and configuring domain and IP options. This process often includes adding specific DNS records for authentication.
Related resources
12 resources
Related pages
Where should SPF, DKIM, and DMARC records be placed for email authentication?
How do SPF, DKIM, DMARC, and dedicated IPs affect email deliverability when using a third-party ESP?
Does a subdomain used for sending emails need its own SPF record?
How to troubleshoot SPF authentication issues with multiple ESPs, subdomains, and CNAMEs?
What are the risks of using the same sending domain on multiple email platforms and IPs?
Should I authenticate email with my own domain or an ESP's domain?
What are the best practices for email domain authentication across corporate and marketing mail?
A simple guide to DMARC, SPF, and DKIM
How to safely transition your DMARC policy to quarantine or reject
Demystifying the SPF TempError in your DMARC reports
