# Authenticating your domain

> Prove the domain is yours with DKIM, point the return path at your own domain, and add DMARC — the one step that decides whether your email reaches the inbox.

Source: https://support.estage.com/email-domain-authentication
Part of the ESTAGE Support help center (https://support.estage.com). Full knowledge base: https://support.estage.com/llms-full.txt

---

Mailbox providers accept mail from strangers reluctantly. **Domain authentication** is how you
stop being a stranger: it proves that email claiming to come from your domain really did.

Skip it and most of what you send lands in spam — and your
[sending level](https://support.estage.com/email-sending-levels) stays at zero, which means nothing goes out at all
beyond test addresses.

## Authenticating

On **Settings → Email sending**, find the **Domain authentication** card and click
**Authenticate domain**.

What happens next depends on who runs your DNS:

- **ESTAGE manages your domain's DNS** (you moved your nameservers to Genesis during
  [domain setup](https://support.estage.com/domains)) — the records are written for you. Nothing to copy.
- **Your DNS is somewhere else** — a table appears with the records to add: **Type**, **Name**
  and **Value** for each. Copy them into your DNS provider exactly.

Either way it usually takes a few minutes for the records to resolve.

> **Note**
>
> The record table is shown right after you click the button. If you navigate away before copying
> them, click **Re-run authentication** to bring them back — it doesn't undo anything or start
> over.

## What the records do

| Record | Why it's there |
| --- | --- |
| **DKIM** | Signs every message so the receiver can verify it wasn't forged or altered. This is the one that makes the domain "authenticated". |
| **MX + TXT on a `mail.` subdomain** | Points the *return path* (where bounces go) at your own domain rather than the mail provider's. That's what lets SPF count towards DMARC. |

> **Caution**
>
> Adding an SPF record to your root domain doesn't help here, and you may see that advice
> elsewhere. SPF would pass for the mail provider but never align with your **From** header, so DMARC would
> still be resting on DKIM alone — the warning clears and nothing is actually fixed. The `mail.`
> records above are what create the alignment.

## Reading the status

The card shows the domain and its badge:

| Badge | Meaning |
| --- | --- |
| **Authenticated** | Done. Sending, senders, deliverability and brand logo all unlock. |
| **DKIM PENDING** | The records aren't resolving yet. Normal for the first few minutes. |
| **DKIM FAILED** | The records are missing or wrong. Re-run authentication and re-copy them. |

Use the refresh icon to re-read the status rather than waiting for the page to be reloaded.

Below the domain you'll also see **Tenant: ENABLED** — that's your project's sending status with
the mail provider. Anything other than `ENABLED` means new mail won't go out; see
[Deliverability](https://support.estage.com/email-deliverability).

### When authentication fails outright

If the attempt itself fails, the reason appears **on the page, under the button**, and stays
there until you try again. It's usually a DNS conflict — the message names the record to find and
delete. Do that, then click **Re-run authentication**.

### Still PENDING after a while

- Check the records are on the **right domain** — a records table copied into the wrong zone
  fails silently.
- Check your DNS provider didn't **append your domain to the Name** twice
  (`mail.mysite.com.mysite.com`). Some control panels do this.
- If ESTAGE manages your DNS, open **Domains → DNS records** in Genesis and confirm the records
  are actually there.

## DMARC

DMARC tells mailbox providers what to do with mail that fails authentication. It isn't part of
the five setup steps, but you'll be prompted for it in two places:

- **Above 5,000 emails a day** — Gmail requires it, so it's a requirement for moving up to that
  [sending level](https://support.estage.com/email-sending-levels).
- **[Brand logo](https://support.estage.com/email-brand-logo)** — BIMI won't show a logo without it.

Publish a DMARC policy at enforcement — `p=quarantine` or `p=reject`. A monitoring-only policy
(`p=none`) satisfies neither requirement.

Add it as a TXT record on `_dmarc.yourdomain.com`, in Genesis under **Domains → DNS records** if
ESTAGE runs your DNS.

## Recommendations

When the mail provider spots an authentication gap it appears under **Recommendations** in the
Deliverability card — DKIM, SPF, DMARC or BIMI, tagged by impact, and marked **resolved** once
fixed. Each one names what to do; the SPF one points back at the `mail.` records above.