Turn on email authentication (SPF, DKIM and DMARC) in the dashboard – IT Solver Support

Mail providers such as Outlook.com, Hotmail and Gmail now reject email that they cannot prove came from you. Three DNS records prove it: SPF, DKIM and DMARC. The IT Solver dashboard turns on SPF and DMARC for you, and DKIM if you use Microsoft 365.

Signs that you need this

You get a bounce message that says "couldn't confirm that your message was sent from a trusted location".
The bounce shows 550 5.7.23, SPF validation error or Message lacks SPF/DKIM/DMARC Auth Records.
Gmail rejects your email and says the message is not authenticated.
Some recipients get your email and other recipients do not, mostly people with Outlook.com, Hotmail or Gmail addresses.
Your email goes to the recipient's junk folder.

Before you start

You must be an Owner, IT manager or Web designer of your business in the dashboard. To turn on DKIM in Microsoft 365, you must be an Owner or IT manager.
Your domain must already have email set up. If it does not, read Set up business email on your domain first.
Your domain must be in the dashboard, with its DNS hosted by IT Solver. If it is not, do the steps in My DNS is with another provider first.

Turn on email authentication

Sign in at dashboard.itsolver.net.
Select Domains, then select your domain.
Select the DNS tab, then go to the Email authentication section.
Select Refresh checks. The dashboard reads your current SPF, DKIM and DMARC records.
In Protect your email, read the list of changes, then select Protect my email.
If you use Microsoft 365 and the dashboard shows Connect Microsoft permissions, select it. On the Approve email signing access page, select Continue to Microsoft.
Sign in with a Global Administrator account for your business, then approve the access. Microsoft returns you to the dashboard, and the setup continues by itself.
Keep the page open until you see Email protection is on. If the dashboard shows Microsoft is still finishing DKIM., keep the page open, or come back later. The dashboard continues.
Send a test email to an Outlook.com or Gmail address.

If you do not see Protect your email, your email protection is already on, or you do not have the Owner, IT manager or Web designer role. Check the SPF, DKIM and DMARC results in Email authentication.

Protect my email makes only the safe changes:

It adds an SPF record for Microsoft 365 or Google Workspace, if you do not have one.
It tells mail providers to reject senders that SPF does not list, when you use Microsoft 365 or Google Workspace and all your known senders are listed.
It turns on DKIM signing in Microsoft 365, if you are an Owner or IT manager.
It turns on DMARC in report-only mode. Report-only mode does not block email. IT Solver reads the reports. If your domain already has DMARC, the dashboard keeps your policy and sends the reports to IT Solver.

If the result is Email protection is on. Some items need IT Solver to review., the safe changes are done. Select the status line to open the details. Each item marked Needs review shows the reason. Email support@itsolver.net with your domain name and those items.

Examples

Microsoft 365: email to Hotmail bounces with "SPF validation error"

You send a receipt to a customer with a Hotmail or Outlook.com address. You get a bounce with 550 5.7.23 and Message lacks SPF/DKIM/DMARC Auth Records. The bounce also shows dkim=none (message not signed).

Microsoft 365 does not sign your email with DKIM, and the domain has no DMARC record. Outlook.com now rejects this email.

To fix it: do the steps in Turn on email authentication. When the dashboard asks, select Connect Microsoft permissions and approve the access. Then send the email again.

Google Workspace: bulk email to clients is rejected

You send one email to many clients from Gmail. Some clients get it, but many copies bounce because the email is not authenticated.

Google Workspace does not sign your email with DKIM until you turn it on in the Google Admin console.

To fix it:

Do the steps in Turn on email authentication. This adds SPF and DMARC.
In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email. Select your domain, then select Generate new record.
Copy the TXT record value. It starts with v=DKIM1;.
Email the value to support@itsolver.net. IT Solver adds the DKIM record for you. If you prefer, add it yourself as a TXT record with the name google._domainkey. See Add, change or delete DNS records.
When the record is added, select Start authentication in the Google Admin console. If Google says that it cannot find the record, try again later. Google says this can take up to 48 hours.
In the dashboard, select Refresh checks.

Google limits how many emails you can send in one day. For newsletters to many clients, use a mailing service such as Mailchimp. Ask us to add that service to your SPF and DKIM.

My DNS is with another provider

Your domain's DNS is hosted with another company. The dashboard cannot change records that another provider controls, so Protect my email does not show. What you do depends on where the domain is registered.

If IT Solver registered the domain, but the DNS is hosted elsewhere:

Select Domains, select your domain, then select the DNS tab.
In Move DNS to IT Solver, select Copy DNS records. The dashboard copies your website and email records. This takes about 30 seconds. Do not close the page.
Check the list of records.
Select I checked the DNS records. If the dashboard also shows Some records are different, missing, or not checked. I want to switch anyway., ask us first if you are not sure, or select it.
Select Switch nameservers.
If the dashboard says that it could not confirm the nameserver change, do not change the nameservers again. Select Check again later.
When the page shows DNS moved to IT Solver, do the steps in Turn on email authentication.

If the domain is registered with another company: the Move DNS to IT Solver panel does not show. Connect the domain to IT Solver DNS. The domain stays registered with that company, and you do not need a transfer code. You must be an Owner or IT manager.

At the top of the dashboard, select the + (Add service) button, then select Connect a domain.
Make sure that Connect a domain is selected, then enter the domain name.
Select Continue. The dashboard prepares IT Solver DNS for the domain and copies your current DNS records.
Check the DNS records. Then, at the company where the domain is registered, change the nameservers to the two nameservers that the dashboard shows.
When the nameservers point to IT Solver, do the steps in Turn on email authentication.

If the dashboard shows We could not connect this domain., email support@itsolver.net with your domain name. You can also transfer the domain to IT Solver with Transfer domains. A transfer needs the transfer code from your current registrar. For more detail, read Change nameservers or move your DNS to IT Solver.

If you do not want to move DNS, send us a request. We send you the records to give to your current provider.

My website also sends email

Your website sends contact form email or order email from your domain. The dashboard finds the website, but the website is not in your SPF record yet. The dashboard does not reject other senders until the website is listed, so your website email keeps working.

To fix it:

If your website is on cPanel hosting, select Add cPanel DKIM. Then email support@itsolver.net and ask us to add the website to your SPF record.
If the website does not send email, select This website does not send mail, then select Refresh checks.

The domain does not send email

You have a domain that you use only for a website, or a domain that you do not use. Other people can still send fake email from it.

To fix it: in Email authentication, select Protect domain from impersonation. The dashboard adds records that tell mail providers to reject all email from that domain. Do not use this on a domain that sends email. For more detail, read Stop others sending email from a domain you do not use for email.

After you turn it on

DMARC starts in report-only mode, so no real email is blocked. When your real email passes SPF and DKIM, go to the DMARC row in Email authentication and select Start filtering suspicious email. Mail providers then send suspicious email that uses your domain to spam or quarantine. If the dashboard warns that SPF or DKIM is not passing yet, select Cancel and ask us first.

Still have a problem?

Forward the bounce message to support@itsolver.net. Include the time you sent the email and the recipient address.

Questions? Email support@itsolver.net or phone 07 3123 6000.