REFERENCE / EMAIL AUTHENTICATION

Email provider authentication directory

Find out how common email services authenticate mail from your domain, what DMARC alignment requires, and where to configure it.

This is a practical, vendor-neutral guide. A provider can return SPF or DKIM pass without satisfying DMARC alignment. Always verify the actual From, Return-Path and DKIM signing domains with a test message.

Find your provider

16 providers

Marketing and transactional

Mailchimp

SPF alignment
Conditional
DKIM alignment
Supported

Standard shared sending generally relies on aligned DKIM; SPF alignment may require a dedicated IP.

Setup notes ↓External provider reference ↗

“Check provider guide” means this page has not independently documented the provider's alignment behavior; it does not indicate a failure or lack of support. Features can vary by product, plan and sender configuration.

Configuration notes

These examples are starting points, not a complete SPF record for every organization. Publish one SPF TXT record per domain, merging all authorized senders. Never overwrite existing sender mechanisms without reviewing them.

Google Workspace

Google Workspace can align SPF when the message is sent using its primary domain. For alias-domain sending, Google's envelope sender generally stays on the primary domain, so DKIM is the important aligned authentication path.

SPF for Google Workspace

v=spf1 include:_spf.google.com ~all

Use this as an example only if Google Workspace is an authorized sender for the SPF domain. If other senders already exist, merge their mechanisms into the single SPF policy.

Enable DKIM

  1. Open the Google Admin console and go to Apps → Google Workspace → Gmail → Authenticate email.
  2. Select your sending domain, generate a 2048-bit DKIM key if available, and copy the TXT host and value supplied by Google.
  3. Publish the exact DNS record in your DNS provider.
  4. Return to the console and start authentication; send a test email to confirm an aligned DKIM pass.

Google's DKIM instructions ↗

Microsoft 365

Microsoft 365 supports both SPF and DKIM alignment for custom domains. Check the tenant's product and cloud environment before applying a generic example.

Common commercial-cloud SPF example

v=spf1 include:spf.protection.outlook.com ~all

Enable DKIM

  1. Open email authentication settings in the Microsoft Defender portal.
  2. Select your verified custom domain and request DKIM signing.
  3. Create the two selector CNAME records using the exact destinations displayed in your tenant.
  4. Enable signing after DNS propagation, then send a test message and inspect the DKIM d= domain.

Microsoft's DKIM setup guide ↗

Mailchimp

With typical shared sending, Mailchimp uses its own envelope-sender domain. SPF may pass for that domain without aligning with your visible From domain. Authenticate your custom sending domain with DKIM instead. Dedicated-IP arrangements can differ.

Authenticate the sending domain

  1. Open Domains in your Mailchimp account and start authentication for the sending domain.
  2. Copy the DKIM CNAME records provided by your account; do not assume the selector names or destinations are identical for every tenant.
  3. Publish the records, complete verification, and send a test message.
  4. Confirm the DKIM d= domain aligns with the visible From domain.

Do not add include:servers.mcsv.net simply to fix DMARC when the envelope sender uses Mailchimp's domain; doing so will not change alignment.

Mailchimp domain authentication guide ↗

Provider behavior can change. Validate changes against current vendor documentation before publishing DNS records.

How to verify DMARC alignment

  1. Send a real message through the provider using your intended From address.
  2. Inspect the raw headers and find Authentication-Results, Return-Path, and the DKIM d= signing domain.
  3. For SPF, confirm both spf=pass and that the authenticated envelope-from domain aligns with the visible From domain.
  4. For DKIM, confirm both dkim=pass and alignment of its d= domain.
  5. DMARC passes when at least one of those authentication mechanisms passes and aligns. Relaxed versus strict alignment follows your DMARC policy.

Analyze a message header → · Check a domain's DNS → · Read the DMARC reference →

Sources and further reading

Inspired by the provider directory at DMARC.wiki ↗. The explanations here are independently written for howto.email; verify provider-specific DNS details with the linked vendor documentation. For protocol details, consult RFC 7489 (DMARC) ↗.