DNS Authentication & the
Auth Score

The Auth Score

Scores range from 0 to 100. A score above 80 indicates strong authentication. Below 40 signals high deliverability risk.

SPF lets a domain owner publish a list of authorized sending IP addresses in their DNS. Receiving mail servers check whether the email came from an authorized IP before accepting it. We perform a live TXT lookup on the Return-Path domain and parse the full SPF record including all include: and redirect= mechanisms.

Common SPF Misconfigurations We Detect

DKIM adds a cryptographic signature to the email headers. The receiving server fetches the sender's public key from DNS and verifies the signature. We extract the DKIM-Signature header, identify the selector (s=) and signing domain (d=), then look up {selector}._domainkey.{d} in DNS and verify the RSA or ed25519 signature.

Common ESP Signing Domains

When a sender signs with their own domain key (not an ESP's domain), it's a strong signal they're using infrastructure they fully control — common for high-volume in-house senders.

DMARC builds on SPF and DKIM by requiring alignment — the From: domain must match the domains used in SPF or DKIM checks. We look up the _dmarc.domain TXT record and parse:

We also record rua= (aggregate report URI), pct= (policy enforcement percentage, commonly used during ramp-up), and sp= (subdomain policy). A DMARC record with p=reject; pct=100 and no missing SPF/DKIM scores a perfect 100.

BIMI is the newest layer of authentication. When properly configured, Gmail, Apple Mail, and Yahoo display the brand's verified logo next to the email in the inbox — increasing open rates by up to 10%. We query default._bimi.domain and store the SVG logo URL. If a competitor has BIMI configured, their logo appears throughout the Competitor Inbox UI.

BIMI Setup Requirements