# Authenticating your domain

> Prove the domain is yours with DKIM, point the return path at your own domain, and add DMARC — the one step that decides whether your email reaches the inbox.

Source: https://knowledge.estage.com/email/domain-authentication/
Part of the ESTAGE knowledge base (https://knowledge.estage.com). Full corpus: https://knowledge.estage.com/llms-full.txt

---
Mailbox providers accept mail from strangers reluctantly. **Domain authentication** is how you
stop being a stranger: it proves that email claiming to come from your domain really did.

Skip it and most of what you send lands in spam — and your
[sending level](/email/sending-levels/) stays at zero, which means nothing goes out at all
beyond test addresses.

## Authenticating

On **Settings → Email sending**, find the **Domain authentication** card and click
**Authenticate domain**.

What happens next depends on who runs your DNS:

- **Estage manages your domain's DNS** (you moved your nameservers to Genesis during
  [domain setup](/domains/)) — the records are written for you. Nothing to copy.
- **Your DNS is somewhere else** — a table appears with the records to add: **Type**, **Name**
  and **Value** for each. Copy them into your DNS provider exactly.

Either way it usually takes a few minutes for the records to resolve.

:::note
The record table is shown right after you click the button. If you navigate away before copying
them, click **Re-run authentication** to bring them back — it doesn't undo anything or start
over.
:::

## What the records do

| Record | Why it's there |
| --- | --- |
| **DKIM** | Signs every message so the receiver can verify it wasn't forged or altered. This is the one that makes the domain "authenticated". |
| **MX + TXT on a `mail.` subdomain** | Points the *return path* (where bounces go) at your own domain rather than the mail provider's. That's what lets SPF count towards DMARC. |

:::caution
Adding an SPF record to your root domain doesn't help here, and you may see that advice
elsewhere. SPF would pass for the mail provider but never align with your **From** header, so DMARC would
still be resting on DKIM alone — the warning clears and nothing is actually fixed. The `mail.`
records above are what create the alignment.
:::

## Reading the status

The card shows the domain and its badge:

| Badge | Meaning |
| --- | --- |
| **Authenticated** | Done. Sending, senders, deliverability and brand logo all unlock. |
| **DKIM PENDING** | The records aren't resolving yet. Normal for the first few minutes. |
| **DKIM FAILED** | The records are missing or wrong. Re-run authentication and re-copy them. |

Use the refresh icon to re-read the status rather than waiting for the page to be reloaded.

Below the domain you'll also see **Tenant: ENABLED** — that's your project's sending status with
the mail provider. Anything other than `ENABLED` means new mail won't go out; see
[Deliverability](/email/deliverability/).

### When authentication fails outright

If the attempt itself fails, the reason appears **on the page, under the button**, and stays
there until you try again. It's usually a DNS conflict — the message names the record to find and
delete. Do that, then click **Re-run authentication**.

### Still PENDING after a while

- Check the records are on the **right domain** — a records table copied into the wrong zone
  fails silently.
- Check your DNS provider didn't **append your domain to the Name** twice
  (`mail.mysite.com.mysite.com`). Some control panels do this.
- If Estage manages your DNS, open **Domains → DNS records** in Genesis and confirm the records
  are actually there.

## DMARC

DMARC tells mailbox providers what to do with mail that fails authentication. It isn't part of
the five setup steps, but you'll be prompted for it in two places:

- **Above 5,000 emails a day** — Gmail requires it, so it's a requirement for moving up to that
  [sending level](/email/sending-levels/).
- **[Brand logo](/email/brand-logo/)** — BIMI won't show a logo without it.

Publish a DMARC policy at enforcement — `p=quarantine` or `p=reject`. A monitoring-only policy
(`p=none`) satisfies neither requirement.

Add it as a TXT record on `_dmarc.yourdomain.com`, in Genesis under **Domains → DNS records** if
Estage runs your DNS.

## Recommendations

When the mail provider spots an authentication gap it appears under **Recommendations** in the
Deliverability card — DKIM, SPF, DMARC or BIMI, tagged by impact, and marked **resolved** once
fixed. Each one names what to do; the SPF one points back at the `mail.` records above.