Skip to content
DMARCLoop
  • Product
    • Features Everything DMARCLoop does
    • Live demo The real app with sample data, no sign-up
    • Large organisations Single sign-on, roles and audit reports
    • Compare DMARCLoop side by side with other tools
  • Free tools
    • Scan your domain Every check at once, graded
    • Domain Checker
    • DMARC Inspector
    • SPF Check
    • DKIM Inspector
    • DKIM Validator
    • MTA-STS Checker
    • MTA-STS Policy Generator
    • DMARC Record Wizard
    • XML-to-human Converter
    • Email Header Analyser
    • All free tools
  • Learn
    • Guides DMARC, SPF and DKIM explained, and set up per service
    • Blog Sender rules, bounces and the road to p=reject
    • Help centre Setting up DMARCLoop, step by step
    • FAQ The questions a rollout raises
    • Glossary The terms, a line or two each
  • Pricing
  • For MSPs
  • Contact
Log in Start free
Learn

Learn email authentication

What DMARC, SPF, DKIM and BIMI are, and how to set them up in the services you already send with. For how DMARCLoop itself works, see the help centre.

Start with the basics

  • What is DMARC? DMARC tells mail receivers what to do with mail that claims to be from your domain but fails SPF and DKIM, and sends you reports on who is sending as you.
  • What is SPF? SPF is the DNS record that lists the servers allowed to send mail for your domain. How it works, its limit of 10 lookups, and why it isn't enough alone.
  • What is DKIM? DKIM signs each message so a receiver can check it came from a server you authorised and wasn't changed on the way. Selectors, keys and alignment explained.
  • What is BIMI? BIMI shows your logo next to your mail in inboxes that support it. What it needs: DMARC at quarantine or reject, an SVG logo and, for Gmail, a VMC or CMC.

Set up the services you send with

One guide per service: DKIM with your domain, SPF where it helps, and how to check it worked.

Mailboxes

  • Google Workspace
  • Microsoft 365
  • Zoho Mail

Transactional email

  • Amazon SES
  • SendGrid
  • Mailgun
  • Postmark
  • SparkPost

Marketing email

  • Mailchimp / Mandrill
  • Brevo (Sendinblue)
  • Mailjet
  • Constant Contact
  • Adobe Marketo

CRM

  • HubSpot
  • Salesforce

Helpdesk

  • Zendesk

Business apps

  • Xero

The road to p=reject

  1. Publish a DMARC record at p=none
  2. Identify every sending source
  3. Fix SPF and DKIM alignment
  4. Move to p=quarantine by day 30
  5. Reach p=reject from day 60

Glossary

From aggregate report to void lookup: the terms a rollout uses, a line or two each.

Open the glossary
DMARCLoop

DMARC monitoring and enforcement for growing businesses, MSPs and enterprises with large domain portfolios.

Product

  • Features
  • Live demo
  • For MSPs
  • Large organisations
  • Pricing
  • Compare

Free tools

  • Scan your domain
  • Domain Checker
  • DMARC Inspector
  • SPF Check
  • DKIM Inspector
  • DKIM Validator
  • MTA-STS Checker
  • MTA-STS Policy Generator
  • DMARC Record Wizard
  • XML-to-human Converter
  • Email Header Analyser

Learn

  • Guides
  • Glossary
  • Blog
  • Help centre
  • FAQ
  • Why SPF/DKIM can pass and DMARC still fails
  • How DMARCLoop identifies sources
  • How to publish a DMARC record
  • Risks of p=reject before every sender is identified
  • Sending DMARC-compliant mail for others

Company

  • Start free
  • Log in
  • Contact
  • Brand
  • Terms of service
  • Privacy
  • Cookies
  • Acceptable use
  • Public tools policy
  • Data processing addendum

© 2026 DMARCLoop. All rights reserved.

We use one analytics cookie to understand how the site and the free tools are used - never the domains you look up. See the privacy policy.