Email authentication proves to recipient servers that your emails are genuinely sent by you — not by someone impersonating your domain. Without authentication, your emails are far more likely to land in spam folders or be rejected entirely. This article explains each authentication protocol, what Apsis handles for you, and what you need to set up on your end.

Email authentication is a set of protocols that verify the identity of the sender. When a recipient's email server receives your message, it checks whether the email is genuinely from the domain it claims to be from. Emails that pass these checks are far more likely to reach the inbox.

The common standards are SPF, DKIM, and DMARC. When you onboard with Apsis (part of the Efficy group), we ensure your emails are authenticated with SPF and help you set up DKIM — so your emails are delivered with the Apsis seal of approval.

SPF prevents forged emails from being sent from an illegitimate source impersonating your domain. It tells recipient servers which mail servers are authorised to send email on behalf of a domain.

DKIM authenticates your "from" domain — the domain your recipients actually see in their inbox (e.g. yourcompany.com). It uses an encryption key and digital signature to prove that you authorised the email and that it hasn't been tampered with in transit. This is the most important authentication protocol for your deliverability.

DKIM significantly decreases the risk of emails landing in spam folders or being caught by spam filters. Without DKIM, a large portion of your emails will very likely be classified as spam when sent to recipients using Gmail, Yahoo, or Outlook/O365. A DKIM failure is far more serious than an SPF failure — it directly affects how recipient servers judge your legitimacy.

DKIM setup is a collaboration between you and the Apsis Delivery team. During onboarding, your Apsis Consultant will guide you through the process. Here's what happens:

If the DKIM setup process feels abstract, this section explains what's actually happening behind the scenes.

DKIM uses asymmetric encryption — a pair of two mathematically linked keys:

Think of it like a wax seal on a letter: the private key is your personal seal stamp (only you have it), and the public key is the reference pattern that anyone can check against to confirm the seal is genuine.

After the Apsis Delivery team generates the key pair, they'll provide you with the public key — a long string of characters that needs to be added to your domain's

Here's what that looks like in practice:

After DKIM is activated, you should verify it's working correctly. The simplest way is to send a test email and inspect the email headers in the recipient's email client.

If DKIM shows PASS, your setup is correct. If it shows FAIL or is missing entirely, the key may not be published correctly in your DNS — contact Apsis to troubleshoot.

You can also verify your DKIM DNS record without sending a test email. Several free online tools let you look up DKIM records directly:

DMARC is an email authentication policy that sits on top of SPF and DKIM. It lets a domain owner tell receiving servers what to do with emails that fail authentication — and get reports back about who is sending email using their domain.

DMARC adds two capabilities that SPF and DKIM alone don't provide:

DMARC is configured as a TXT record in your domain's DNS. The policy is set using the p= tag:

DMARC adoption is growing rapidly, especially among larger organisations, financial institutions, government agencies, and any company that has experienced — or wants to prevent — email spoofing. Common reasons include:

This is where it gets important: if your organisation implements or tightens a DMARC policy without having DKIM set up for Apsis One, your email deliverability will break.

Here's why. When you send an email through Apsis One, the technical sender domain is apsisone.com (covered by Apsis's SPF), but the "from" domain is your domain (e.g. yourcompany.com). DMARC checks whether the email is authenticated for the "from" domain. SPF alone won't pass DMARC alignment here because the SPF domain (apsisone.com) doesn't match the "from" domain (yourcompany.com). The only way Apsis One emails pass DMARC for your domain is through DKIM — because DKIM is signed with your domain's key.

So if DMARC is set to p=quarantine or p=reject and DKIM is not set up:

The receiving server sees an email claiming to be from your domain, checks DMARC, finds no valid DKIM signature, and treats the email as potentially fraudulent. Your legitimate marketing emails are flagged as "not authorised by the domain owner."

DMARC is configured on your domain's DNS by you or your IT team. If you're unsure about your current DMARC policy or need help coordinating with your IT team, reach out to your Apsis Consultant or Customer Service.

Every email is sent from an IP address. The reputation of that IP address affects whether your email is accepted by the recipient's server.

TLS encrypts data while it's sent over the internet, preventing hackers from intercepting the content in transit. It's a cryptographic protocol that provides end-to-end security between applications — especially important for private and sensitive information.

Apsis requires at least TLS encryption 1.2.

With forced TLS, emails are only sent through channels that require TLS encryption. If the recipient's mail server does not support encryption, the connection is dropped and the email is discarded — which means you may experience slightly higher bounce rates.

To enable forced TLS encryption for all types of sending (including Email tool), contact the Support Team. When enabled, it covers all Sections in your account.