Authentication
Mechanisms (SPF, DKIM, DMARC) that prove an email actually came from the sender it claims to be from.
Email authentication is the set of DNS-based mechanisms that let a receiving mail server verify that an email genuinely came from the domain it claims to be from. The three primary mechanisms are SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance).
SPF declares which servers are allowed to send mail for a domain. DKIM cryptographically signs each email so the recipient can verify it wasn't altered in transit and was sent by an authorized server. DMARC sits on top of SPF and DKIM and tells receivers what to do when authentication fails (reject, quarantine, or just report).
Since 2024, Gmail and Yahoo require all senders of 5,000+ emails per day to have SPF, DKIM, and DMARC properly configured, or their mail will go to spam. For any production email program, authentication isn't optional. Misconfigured authentication is the single most common cause of sudden deliverability drops.