Authentication explained for senders.
SPF
Lists which servers may send for your domain.
When you add a sending platform, its mechanism must be added to your existing SPF record.
One record only. Two SPF records is an error and causes failures.
DKIM
A cryptographic signature proving the message was authorised and not altered.
Your platform provides a record to publish. Add it exactly.
DMARC
A policy telling receivers what to do with mail failing the other two, and where to send reports.
Start with a monitoring policy. Read the reports for a few weeks. Then tighten if you are confident.
WHY ALL THREE
Gmail and other major providers increasingly require proper authentication for bulk senders.
Without them your mail is filtered regardless of content.
CHECKING
Send to a Gmail address, open the message, and view the original. It shows the authentication results explicitly.
All three should pass.
AFTER ADDING A PLATFORM
Check again. Adding a sender without updating SPF breaks authentication for that sender.
