Authenticating your domain

Mailbox providers accept mail from strangers reluctantly. Domain authentication is how you stop being a stranger: it proves that email claiming to come from your domain really did.

Skip it and most of what you send lands in spam — and your sending level stays at zero, which means nothing goes out at all beyond test addresses.

Authenticating

On Settings → Email sending, find the Domain authentication card and click Authenticate domain.

What happens next depends on who runs your DNS:

• Estage manages your domain’s DNS (you moved your nameservers to Genesis during domain setup) — the records are written for you. Nothing to copy.
• Your DNS is somewhere else — a table appears with the records to add: Type, Name and Value for each. Copy them into your DNS provider exactly.

Either way it usually takes a few minutes for the records to resolve.

Note

The record table is shown right after you click the button. If you navigate away before copying them, click Re-run authentication to bring them back — it doesn’t undo anything or start over.

What the records do

Record	Why it’s there
DKIM	Signs every message so the receiver can verify it wasn’t forged or altered. This is the one that makes the domain “authenticated”.
MX + TXT on a mail. subdomain	Points the return path (where bounces go) at your own domain rather than the mail provider’s. That’s what lets SPF count towards DMARC.

Caution

Adding an SPF record to your root domain doesn’t help here, and you may see that advice elsewhere. SPF would pass for the mail provider but never align with your From header, so DMARC would still be resting on DKIM alone — the warning clears and nothing is actually fixed. The mail. records above are what create the alignment.

Reading the status

The card shows the domain and its badge:

Badge	Meaning
Authenticated	Done. Sending, senders, deliverability and brand logo all unlock.
DKIM PENDING	The records aren’t resolving yet. Normal for the first few minutes.
DKIM FAILED	The records are missing or wrong. Re-run authentication and re-copy them.

Use the refresh icon to re-read the status rather than waiting for the page to be reloaded.

Below the domain you’ll also see Tenant: ENABLED — that’s your project’s sending status with the mail provider. Anything other than ENABLED means new mail won’t go out; see Deliverability.

When authentication fails outright

If the attempt itself fails, the reason appears on the page, under the button, and stays there until you try again. It’s usually a DNS conflict — the message names the record to find and delete. Do that, then click Re-run authentication.

Still PENDING after a while

• Check the records are on the right domain — a records table copied into the wrong zone fails silently.
• Check your DNS provider didn’t append your domain to the Name twice (mail.mysite.com.mysite.com). Some control panels do this.
• If Estage manages your DNS, open Domains → DNS records in Genesis and confirm the records are actually there.

DMARC

DMARC tells mailbox providers what to do with mail that fails authentication. It isn’t part of the five setup steps, but you’ll be prompted for it in two places:

• Above 5,000 emails a day — Gmail requires it, so it’s a requirement for moving up to that sending level.
• Brand logo — BIMI won’t show a logo without it.

Publish a DMARC policy at enforcement — p=quarantine or p=reject. A monitoring-only policy (p=none) satisfies neither requirement.

Add it as a TXT record on _dmarc.yourdomain.com, in Genesis under Domains → DNS records if Estage runs your DNS.

Recommendations

When the mail provider spots an authentication gap it appears under Recommendations in the Deliverability card — DKIM, SPF, DMARC or BIMI, tagged by impact, and marked resolved once fixed. Each one names what to do; the SPF one points back at the mail. records above.