Email authentication is the set of technical signals used to determine whether an email was legitimately sent and how much it should be trusted. This tag covers protocols like SPF, DKIM, DMARC, and ARC — explaining what they actually prove, where they fall short, and how they shape modern inbox decisions.
The address you see in an email isn’t always the one that actually sent it. Behind every message are multiple “from” identities — each with a different technical role. Understanding them explains spam checks, bounces, and why email authentication exists at all.
DMARC defines what happens when email authentication fails, turning SPF and DKIM results into clear policy decisions that protect domains from spoofing and abuse.
DKIM (DomainKeys Identified Mail) doesn’t verify who sent an email. It verifies that the message hasn’t been altered since it was signed, and that a domain takes responsibility for its contents. Understanding DKIM means understanding what it proves — and what it deliberately ignores.
SPF doesn’t verify who sent an email — it only confirms that a server was allowed to deliver it. That distinction explains why SPF passes during phishing, fails during forwarding, and can’t be treated as a trust signal on its own.
Email authentication relies on SPF, DKIM, and DMARC — a set of interlocking systems — but most people misunderstand what they really do, and what they don’t protect.
Email forwarding in HEY works differently than many expect. Here’s why issues happen, what authentication has to do with it, and what users should know.
