Turn on email authentication (SPF, DKIM and DMARC) in the dashboard

Mail providers such as Outlook.com, Hotmail and Gmail now reject email that they cannot prove came from you. Three DNS records prove it: SPF, DKIM and DMARC. You can turn on all three from the IT Solver dashboard in a few minutes.

Signs that you need this

• You get a bounce message that says "couldn't confirm that your message was sent from a trusted location".
• The bounce shows 550 5.7.23, SPF validation error or Message lacks SPF/DKIM/DMARC Auth Records.
• Gmail rejects your email and says the message is not authenticated.
• Some recipients get your email and other recipients do not, mostly people with Outlook.com, Hotmail or Gmail addresses.
• Your email goes to the recipient's junk folder.

Before you start

• You must be an owner or IT manager of your business in the dashboard.
• Your domain must be in the dashboard, with its DNS managed by IT Solver. If it is not, do the steps in My DNS is with another provider first.

Turn on email authentication

1. Sign in at dashboard.itsolver.net.
2. Select Domains, then select your domain.
3. Go to the Email authentication section.
4. Select Refresh checks. The dashboard reads your current SPF, DKIM and DMARC records.
5. In Protect your email, read the list of changes, then select Protect my email.
6. If you use Microsoft 365 and the dashboard shows Connect Microsoft permissions, select it. Sign in with a Microsoft 365 admin account and approve the access. The dashboard then continues by itself.
7. Keep the page open until you see Email protection is on. DKIM in Microsoft 365 can take a few minutes. If you close the page, come back later and the dashboard continues.
8. Send a test email to an Outlook.com or Gmail address.

Protect my email does only the safe changes:

• It adds an SPF record for your mail provider, if you do not have one.
• It tells mail providers to reject senders that SPF does not list, when all your known senders are listed.
• It turns on DKIM signing in Microsoft 365.
• It turns on DMARC in report-only mode. Report-only mode does not block email. IT Solver reads the reports.

If the result is Email protection is on. Some items need IT Solver to review., the safe changes are done. IT Solver gets the other items and contacts you if we need something from you.

Examples

Microsoft 365: email to Hotmail bounces with "SPF validation error"

You send a receipt to a customer with a Hotmail or Outlook.com address. You get a bounce with 550 5.7.23 and Message lacks SPF/DKIM/DMARC Auth Records. The bounce also shows dkim=none (message not signed).

Microsoft 365 does not sign your email with DKIM, and the domain has no DMARC record. Outlook.com now rejects this email.

To fix it: do the steps in Turn on email authentication. When the dashboard asks, select Connect Microsoft permissions and approve the access. Then send the email again.

Google Workspace: bulk email to clients is rejected

You send one email to many clients from Gmail. Some clients get it, but many copies bounce because the email is not authenticated.

Google Workspace does not sign your email with DKIM until you turn it on in the Google Admin console.

To fix it:

1. Do the steps in Turn on email authentication. This adds SPF and DMARC.
2. In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email. Select your domain, then select Generate new record.
3. Copy the TXT record value. It starts with v=DKIM1;.
4. In the dashboard, in Email authentication, find the DKIM row for Google Workspace. Paste the value into TXT value, then select Setup DKIM.
5. Wait 10 minutes. In the Google Admin console, select Start authentication.
6. In the dashboard, select Refresh checks.

Google limits how many emails you can send in one day. For newsletters to many clients, use a mailing service such as Mailchimp. Ask us to add that service to your SPF and DKIM.

My DNS is with another provider

Your domain is registered or hosted with another company, for example Crazy Domains or GoDaddy. The dashboard cannot change records that another provider controls, so Protect my email does not show.

To fix it:

1. Select Domains, then select your domain.
2. In Move DNS to IT Solver, select Copy DNS records. The dashboard copies your website and email records. This takes about 30 seconds.
3. Check the records the dashboard shows, then follow the steps on the page to change the nameservers.
4. When the page shows DNS moved to IT Solver, do the steps in Turn on email authentication.

If you do not want to move DNS, send us a request. We send you the records to give to your current provider.

My website also sends email

Your website sends contact form email or order email from your domain. The dashboard finds the website, but the website is not in your SPF record yet. The dashboard does not reject other senders until the website is listed, so your website email keeps working.

To fix it:

• If your website is on cPanel hosting, select Add cPanel DKIM. Then ask us to add the website to SPF.
• If the website does not send email, select This website does not send mail, then select Refresh checks.

The domain does not send email

You have a domain that you use only for a website, or a domain that you do not use. Other people can still send fake email from it.

To fix it: in Email authentication, select Protect domain from impersonation. The dashboard adds records that tell mail providers to reject all email from that domain. Do not use this on a domain that sends email.

After you turn it on

DMARC starts in report-only mode, so no real email is blocked. After your email passes for a few weeks, you can select Start filtering suspicious email. Mail providers then send fake email that uses your domain to junk. Ask us if you are not sure that all your senders pass.

Still have a problem?

Forward the bounce message to support@itsolver.net. Include the time you sent the email and the recipient address.