Anyone can type any address into the From field of an email. Authentication is how receiving servers tell the real sender from an impostor, and how mailbox providers decide whether to trust you.
The three checks
| Check | What it proves | Where it lives |
|---|---|---|
| SPF | The sending server is allowed to send for the domain | A TXT record on the domain |
| DKIM | The message was signed by the domain and not changed on the way | A public key in DNS, a signature in the message |
| DMARC | SPF or DKIM passed and matched the visible From domain, plus what to do if not | A TXT record at _dmarc |
BIMI is an optional fourth step that shows your logo in the inbox once DMARC is enforced.
Why it is not optional
Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders. Gmail defines bulk as more than 5,000 messages a day to Gmail accounts, and Yahoo publishes no volume threshold. Other providers weigh authentication too. Mail that fails is more likely to land in spam or be refused outright. Authentication also protects your brand: without DMARC enforcement, anyone can send mail that looks like yours.
Authentication in Amazon SES
SES gives you most of the parts. Easy DKIM supplies the DKIM records, a custom MAIL FROM domain lets SPF line up with your From address, and you publish the DMARC record yourself. The pieces only work together when the domain in each one is the same, which is the idea behind DMARC alignment.
The catch
Records break quietly. Someone changes DNS providers, a record is deleted in a clean-up, a second SPF record is added. Mail keeps flowing for a while, then drifts into spam. That is why authentication needs watching, not just setting up once.
Common questions
Do I need all three of SPF, DKIM and DMARC?
For any serious sending, yes. Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and a DMARC policy of none is enough to meet that rule. DMARC is the piece that ties SPF and DKIM to your visible From address.
Is authentication enough to reach the inbox?
No. It proves who you are, not that you are wanted. Reputation and engagement decide the rest.