Question 1

What is email domain authentication and why does my domain need DKIM, SPF, and DMARC?

Accepted Answer

Email domain authentication is the set of DNS-based standards that prove your domain authorized a specific email to be sent on its behalf. **DKIM (DomainKeys Identified Mail)** cryptographically signs every outbound message with a private key whose public counterpart is published in your DNS — the receiving server verifies the signature against the published key. **SPF (Sender Policy Framework)** publishes the IP addresses authorized to send from your domain. **DMARC (Domain-based Message Authentication, Reporting and Conformance)** ties DKIM and SPF together and tells receiving servers what to do when authentication fails (none/quarantine/reject) plus where to send aggregate reports. **Gmail and Yahoo now require all three for senders over 5,000 messages per day** as of February 2024 — without proper authentication, your mail will be silently filtered or rejected outright.

Question 2

How is DKIM setup handled by Inbox OSS?

Accepted Answer

Setup is **three CNAMEs and a verification step**. Add em1._domainkey, em2._domainkey, and em._domainkey-management to your domain as CNAMEs pointing to our authoritative DNS (we display the exact target hostnames in the dashboard wizard). We host the actual TXT records containing the DKIM public key on our authoritative servers, so when your DKIM key rotates we update the record without you touching DNS. Each sending domain gets its own RSA-2048 keypair generated in our HSM-backed key vault; the private key is encrypted with AES-256-GCM at rest and never leaves the signing infrastructure. The dashboard verifies the CNAMEs resolved correctly before activating sending, typically completing the setup in under 5 minutes.

Question 3

How does SPF setup work?

Accepted Answer

Add a single TXT record to your domain root: **v=spf1 include:inboxsoft.email -all** (the exact include directive is shown in the dashboard for your specific account region). The include pulls in our maintained SPF record listing every authorized sending IP across the platform, so when we add or remove IPs the include resolves automatically — you do not have to update your SPF when our infrastructure changes. **The hard-fail "-all" is important**: it tells receiving servers to reject mail claiming to come from your domain that originates from any non-authorized IP. Soft-fail "~all" is acceptable during transition but eventually you want -all because it blocks spoofing attacks on your domain. For domains that send from multiple providers, our SPF flattening tool produces a single optimized record that stays under the 10-lookup DNS limit.

Question 4

How does DMARC reporting work?

Accepted Answer

Add a TXT record at _dmarc.yourdomain.com: **v=DMARC1; p=none; rua=mailto:dmarc@inboxsoft.email; pct=100**. The rua endpoint we provide collects daily aggregate XML reports from every receiving server that processed mail from your domain; we parse the XML and visualize results in your dashboard with a per-source, per-result breakdown (pass/fail by source, alignment failures, geographic split of sending sources). Start at p=none (monitor mode) to see what is sending from your domain before tightening policy. Once you see only authorized sources passing, move to p=quarantine (failing mail goes to spam folder) and finally p=reject (failing mail is rejected at the gateway). DMARC reporting is the only way to discover unauthorized senders spoofing your domain.

Question 5

What is BIMI and how do I set it up?

Accepted Answer

BIMI (Brand Indicators for Message Identification) is the standard that displays your **brand logo next to authenticated emails in Gmail, Apple Mail, and Yahoo Mail**. Three requirements: (1) your domain is at DMARC p=quarantine or p=reject, (2) you have a Verified Mark Certificate (VMC) from DigiCert or Entrust proving you own the trademark on the logo, (3) you publish your SVG logo and VMC at a stable URL referenced from a BIMI TXT record. **Inbox OSS hosts both the SVG and the VMC on your tracking domain** with automatic refresh, so setup once you have the VMC is a single TXT record add. BIMI noticeably improves open rates — internal benchmarks show 5-15 percent lift for brands with high visual recognition.

Question 6

What is MTA-STS and TLS-RPT?

Accepted Answer

MTA-STS (Mail Transfer Agent Strict Transport Security) is the SMTP equivalent of HTTP HSTS — it tells sending servers that mail to your domain MUST use TLS and lists which MX targets are authorized. This prevents downgrade attacks where a malicious network operator strips STARTTLS from the SMTP handshake. TLS-RPT (TLS Reporting) configures where receiving servers should send TLS failure reports. **Inbox OSS hosts both policies automatically on your tracking domain** when you enable the feature — you add two CNAMEs (mta-sts and _smtp._tls) and we serve the policy file and report-collection endpoint. Recent Google guidance recommends MTA-STS for all production sending domains, and it is required for the highest BIMI tier.

Question 7

How does DKIM key rotation work?

Accepted Answer

DKIM keys should rotate every 6-12 months as a security best practice. Inbox OSS handles rotation **with zero downtime**: the new key (em2._domainkey) is generated and published alongside the existing key (em._domainkey) for a transition window (configurable, default 30 days). During the transition, signing happens with the new key while the old key remains publishable for in-flight verification of older messages. At the end of the window, the old key is rotated out and a fresh one generated to take the second slot. The dashboard tracks rotation history with full audit logs of key generation, activation, and retirement timestamps. **Other platforms either do not rotate or require a manual DNS change** — Inbox OSS rotates automatically on a schedule you configure.

Question 8

Can I authenticate multiple sending domains under one account?

Accepted Answer

Yes — there is no limit on the number of sending domains per account. Each domain gets its own DKIM keypair, its own SPF include verification, its own DMARC policy and reporting, and its own BIMI/MTA-STS configuration independent of the others. This is critical for agencies, multi-brand companies, and white-label SaaS products where each tenant has its own domain. The dashboard supports programmatic domain registration via API so you can provision a customer-specific authenticated domain at signup time. Suppressions, billing, and analytics are unified at the account level while authentication is fully isolated per-domain.

Question 9

How does this compare to SendGrid Domain Authentication or Mailgun Domains?

Accepted Answer

SendGrid and Mailgun both support DKIM, SPF, and DMARC at production quality. Inbox OSS differs on three dimensions: (1) **DKIM key rotation is automatic** out of the box (SendGrid requires a manual key-rotation flow; Mailgun does not rotate at all); (2) **MTA-STS and TLS-RPT hosting is included** in every paid plan (SendGrid does not offer this; Mailgun requires manual setup); (3) **DMARC report parsing is built into the dashboard** with a visual per-source breakdown (SendGrid sells DMARC reporting as a separate paid add-on; Mailgun does not parse at all). Migration from either is one-click: the wizard reads your existing DKIM and SPF state and produces the new CNAMEs for cutover.

Question 10

What happens if my domain authentication is misconfigured?

Accepted Answer

The dashboard runs **continuous DNS verification every 15 minutes** across all configured domains and surfaces any failures (CNAME removed, key rotated incorrectly, SPF include broken, DMARC syntax error) with both a dashboard alert and an email to the account owner. We block sends from any domain where authentication is broken to prevent damaging your sender reputation by emitting unauthenticated mail. The Compliance page provides a one-click diagnostic that tests every authentication primitive against your live DNS and reports the exact remediation if anything is off. This is materially more proactive than competitors — SendGrid will silently keep sending with broken authentication, eventually getting your reputation destroyed at Gmail and Outlook.

DKIM, SPF, and DMARC — handled.

Per-domain DKIM

CNAME delegation

Key rotation

DMARC reporting

BIMI-ready

MTA-STS + TLS-RPT

Frequently asked questions about email domain authentication

Authenticate in 3 CNAMEs.