Email Authentication
Email authentication is the set of technical checks that proves your mail is really from your domain and has not been tampered with in transit.
Email authentication is the set of DNS records and signatures that let a receiving server check who sent a message and whether it changed in transit. The three standards in use are SPF, DKIM and DMARC.
How the three fit together
SPF lists which servers may send mail for your domain. DKIM signs each message so the receiver can verify it was authorized by your domain and not altered. DMARC ties both to the visible From address, tells receivers what you want done when neither aligned check passes, and sends you reports so you can see who is sending as your domain.
Each one is a DNS record you publish, plus configuration at whatever service sends your mail.
Why it matters
Without authentication a receiver has no reliable way to tell your mail from someone spoofing your domain. Authentication does not by itself get mail into the inbox, so check both authentication results and the receiving server’s response when investigating deliverability problems.
Common mistakes
Treating setup as a one-time task. Records drift as domains, vendors and sending tools change, and a new vendor that sends as your domain with neither aligned SPF nor aligned DKIM will fail DMARC until someone notices. Another is configuring SPF, DKIM and DMARC separately without checking that the domains they pass for align with the visible From domain. Authentication also gets blamed for problems it cannot fix, such as mail sent to a stale list.