Authenticating your domain
Prove the domain is yours with DKIM, point the return path at your own domain, and add DMARC — the one step that decides whether your email reaches the inbox.
Mailbox providers accept mail from strangers reluctantly. Domain authentication is how you stop being a stranger: it proves that email claiming to come from your domain really did.
Skip it and most of what you send lands in spam — and your sending level stays at zero, which means nothing goes out at all beyond test addresses.
Authenticating
On Settings → Email sending, find the Domain authentication card and click Authenticate domain.
What happens next depends on who runs your DNS:
- ESTAGE manages your domain's DNS (you moved your nameservers to Genesis during domain setup) — the records are written for you. Nothing to copy.
- Your DNS is somewhere else — a table appears with the records to add: Type, Name and Value for each. Copy them into your DNS provider exactly.
Either way it usually takes a few minutes for the records to resolve.
Note
The record table is shown right after you click the button. If you navigate away before copying them, click Re-run authentication to bring them back — it doesn't undo anything or start over.
What the records do
| Record | Why it's there |
|---|---|
| DKIM | Signs every message so the receiver can verify it wasn't forged or altered. This is the one that makes the domain "authenticated". |
MX + TXT on a mail. subdomain |
Points the return path (where bounces go) at your own domain rather than the mail provider's. That's what lets SPF count towards DMARC. |
Caution
Adding an SPF record to your root domain doesn't help here, and you may see that advice
elsewhere. SPF would pass for the mail provider but never align with your From header, so DMARC would
still be resting on DKIM alone — the warning clears and nothing is actually fixed. The mail.
records above are what create the alignment.
Reading the status
The card shows the domain and its badge:
| Badge | Meaning |
|---|---|
| Authenticated | Done. Sending, senders, deliverability and brand logo all unlock. |
| DKIM PENDING | The records aren't resolving yet. Normal for the first few minutes. |
| DKIM FAILED | The records are missing or wrong. Re-run authentication and re-copy them. |
Use the refresh icon to re-read the status rather than waiting for the page to be reloaded.
Below the domain you'll also see Tenant: ENABLED — that's your project's sending status with
the mail provider. Anything other than ENABLED means new mail won't go out; see
Deliverability.
When authentication fails outright
If the attempt itself fails, the reason appears on the page, under the button, and stays there until you try again. It's usually a DNS conflict — the message names the record to find and delete. Do that, then click Re-run authentication.
Still PENDING after a while
- Check the records are on the right domain — a records table copied into the wrong zone fails silently.
- Check your DNS provider didn't append your domain to the Name twice
(
mail.mysite.com.mysite.com). Some control panels do this. - If ESTAGE manages your DNS, open Domains → DNS records in Genesis and confirm the records are actually there.
DMARC
DMARC tells mailbox providers what to do with mail that fails authentication. It isn't part of the five setup steps, but you'll be prompted for it in two places:
- Above 5,000 emails a day — Gmail requires it, so it's a requirement for moving up to that sending level.
- Brand logo — BIMI won't show a logo without it.
Publish a DMARC policy at enforcement — p=quarantine or p=reject. A monitoring-only policy
(p=none) satisfies neither requirement.
Add it as a TXT record on _dmarc.yourdomain.com, in Genesis under Domains → DNS records if
ESTAGE runs your DNS.
Recommendations
When the mail provider spots an authentication gap it appears under Recommendations in the
Deliverability card — DKIM, SPF, DMARC or BIMI, tagged by impact, and marked resolved once
fixed. Each one names what to do; the SPF one points back at the mail. records above.