---
title: "Sending domain and authentication · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication
updated: 2026-10-20
licence: "All rights reserved"
---

# Sending domain and authentication

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Prove each message is yours with SPF, DKIM and DMARC on aligned domains, and send it over checked TLS, or large inboxes reject it.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication`.

## Required

- [Publish an SPF record](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf): Publish one SPF record for every domain that sends mail, listing every server and service that sends for it.
- [Sign every message with DKIM](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim): Sign every message with DKIM, using a 2048-bit RSA key on your own domain, and replace each key at least every six months.
- [Enforce DMARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc): Publish a DMARC record, read its reports, and move from `p=none` to `p=quarantine` and then `p=reject` once all mail passes.
- [Lock down domains that never send mail](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains): Give every domain and subdomain that sends no mail a null MX, an SPF record of `v=spf1 -all` and a DMARC record with `p=reject`.
- [Give sending servers matching DNS names](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/reverse-dns): Give every sending IP address a reverse DNS name that points back to the same address, and use that name in the SMTP greeting.
- [Send and receive over TLS](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls): Offer STARTTLS with a valid certificate on every MX host, and send outgoing mail over TLS.

## Optional

- [Pin mail TLS with DANE](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane): If your domain is signed with DNSSEC, publish TLSA records for your MX hosts, so sending servers check the certificate through DNS.
- [Keep authentication through forwarders with ARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc): If you run a mailing list or forwarding service, add ARC seals, so receivers can trust results that the forwarding broke.
- [Show your logo with BIMI](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/bimi): Once DMARC is enforced, publish a BIMI record, so supporting inboxes show your verified logo next to your mail.

- Previous: [Message basics](https://agentwranglers.se/playbook/email/message-basics)
- Next: [Deliverability](https://agentwranglers.se/playbook/email/deliverability)
- [All chapters](https://agentwranglers.se/playbook/email)