How to Authenticate Your Sending Domain in One Afternoon
How to authenticate your sending domain: three records on a domain you own, a subdomain for marketing, and the check that keeps nurture out of the spam folder.
To authenticate your sending domain, publish three records on a domain you own: SPF lists who may send for it, DKIM signs each message, DMARC says what happens when checks fail. Do it before you send nurture at any volume. Skip it and careful emails land in spam.
How to authenticate your sending domain before the first email
Here's the part nobody tells you. Your nurture sequence can be well written, well timed and well targeted, and still do nothing. Not because it's bad. Because it never arrived.
It fails silently. The sequence runs. The dashboard shows sends. A meaningful share of that mail sits in spam folders or is never accepted at all, and nothing tells you.
That's why this job comes first. Not after the copy. Before it.
Mailbox providers decide whether to trust a message partly by checking that it really came from who it claims to come from. You can't argue with that check. You can only pass it. Passing takes three records and one afternoon.
Most solo operators skip it because it looks like IT work. It is IT work. It's also the cheapest insurance in your whole business.
Authenticate your sending domain with three records
Forget the acronyms for a second. Think of a letter arriving at a front desk. To authenticate your sending domain, you publish all three.
| Record | What it does | Think of it as |
|---|---|---|
| SPF | Lists the servers allowed to send mail for your domain | The guest list at the door |
| DKIM | Signs each message so it provably was not altered on the way | A wax seal on the envelope |
| DMARC | Tells providers what to do when a message fails those checks | The instruction to the doorman |
You need all three. Not one. Not two. The guest list without the seal is half a job, and the instruction to the doorman means nothing if there is no list to check against.
Each one answers a different question. Is this server allowed? Is this message intact? And what should we do if the answer is no?
If you only remember one thing: all three, on a domain you own, published and verified.
Free guide · 21 pagesMost leads are early, not uninterested.The Email Nurture Playbook: sequences, exits, timing and the plumbing that decides if it arrives.Get the free guide →Own the domain. Do not borrow one.
This is where the shortcut costs you most.
A shared domain means you share a reputation with strangers. Someone else's careless sending becomes your spam problem, and you can't fix it because you don't control it. An unauthenticated or shared domain is the most common reason careful sequences land in spam.
Careful. That sentence says careful sequences. People who did everything right on the writing side and still got burned.
So the rule is blunt. Send from a domain you own. Then prove it's yours with the three records above.
Say you run a productised service and you've been mailing leads from whatever address your tool gave you on day one. Today's job is simple. Move the sending to your own domain, publish the records, and check they verify. Then, and only then, switch the sequence on.
Give marketing its own subdomain
Here's the decision most people never make, and it's the one that protects you.
Many people send marketing from a subdomain. The reason is containment. If a marketing reputation problem happens, it can't contaminate the domain that carries your invoices, your client replies and your password resets.
Read that list again. Invoices. Client replies. Password resets.
Those are the emails that pay you and keep customers logged in. You don't want a bad week of nurture to push them into spam. When you work alone, there's nobody else to notice that a client never got your invoice. You find out when the money doesn't arrive.
So decide it now. Does marketing mail use its own subdomain? The guide's checklist puts this as a question you answer before the first sequence goes live. I'd answer yes, and I'd answer it today.
This ties straight into a mistake covered in the email nurture mistakes to avoid: sending from an unauthenticated or shared domain is the one that hides best, behind a dashboard full of sends.
What to do on the day
To authenticate your sending domain, you don't need to become an email engineer. You need to tick four boxes.
- Pick the domain. One you own, not a shared one. Decide whether marketing gets its own subdomain.
- Publish SPF, DKIM and DMARC. All three. Your sending tool will show you the records it wants. You add them where your domain is managed.
- Verify them. Published is not the same as working. Check each one shows as verified before you send anything.
- Set the sender. Mail from your own name, at an address that accepts replies.
That last point isn't decoration. A no-reply address tells the reader you don't want to hear from them. And replies are among the strongest buying signals you will ever get. Authentication gets you into the inbox. A real address keeps you there and lets the answer come back.
One more thing about the sender name. Mail that comes from you, by name, reads like a message. Mail from a faceless brand address reads like marketing. You have an advantage here that a company does not: the named human is you. Authentication makes sure that human is believed.
If you can't tick all four, that's your next task. Not the third email. This.
Authentication is the floor, not the ceiling
Let me be straight about what the three records do and don't do.
They prove who you are. They don't prove you're worth reading. A fully authenticated sender who mails people who never asked, or who ignores the unsubscribe link, still builds a bad reputation. Mailbox providers judge you constantly on how recipients react.
So authentication is one third of the plumbing. The guide names three parts of deliverability: authenticate the domain, suppress permanently and everywhere, keep the list clean. Skip any of them and the others can't save you.
Suppression is the second part. Hard bounces, spam complaints and unsubscribes belong on a list checked before every send, of every kind. Cleaning is the third, and it has its own post: how to clean an email list.
Once the plumbing is in, watch it. The monthly review asks two plain questions. Are bounce and complaint rates stable or falling? Are hard bounces and complaints on the suppression list? Treat a rise as an incident, not a curiosity.
Free assessmentHow trapped are you, really?Take the Corporate Suffocation Index, the free solopreneur readiness assessment.Take the assessment →What goes wrong when you skip it
| What you did | What happens | What you see |
|---|---|---|
| Sent from a shared domain | You inherit other senders' reputation | Nothing. The dashboard shows sends. |
| Published one record, not three | Providers can't fully check you | Fewer replies, no explanation |
| Marketing and invoices on one domain | A bad nurture week hurts your invoices too | A client says they never got it |
| Never verified the records | You assumed they worked | Silence |
The pattern is the same every row. You see nothing. That's what makes it dangerous. A sequence that never reaches the inbox has no conversion rate to improve.
Why this matters more when you work alone
A company has someone whose job is deliverability. You have you.
That sounds like a disadvantage, but it's also a reason to keep this simple. You don't need a clever setup. You need a domain you own, three records, a subdomain for marketing if you choose, and a monthly look at the health numbers.
Authenticate your sending domain once, in one afternoon. Then the sequence you build next has a fair chance of being read by the person you wrote it for.
If you're deciding how long that sequence should be, how many emails a nurture sequence should have is the next question. Settle the plumbing first.
Free guide · 21 pagesMost leads are early, not uninterested.The Email Nurture Playbook: sequences, exits, timing and the plumbing that decides if it arrives.Get the free guide →The objection you are about to make
"I only have a small list. Surely this can wait."
It can't, and the reason is awkward. A small list makes each bad outcome louder, not quieter. If a handful of your first leads never see the welcome email, you've lost the exact people you worked hardest to attract, and you'll never know why they went quiet.
Worse, you'll blame the wrong thing. You'll rewrite subject lines. You'll shorten the sequence. You'll doubt the offer. The real fault was a missing record.
Fix the cheap thing first. It takes an afternoon. A rewritten sequence takes a week.
Free assessmentHow trapped are you, really?Take the Corporate Suffocation Index, the free solopreneur readiness assessment.Take the assessment →Frequently asked questions
Do I need all three records to authenticate your sending domain?
Yes. SPF lists who may send, DKIM signs the message, DMARC tells providers what to do on a failure. They do different jobs. Have all three in place on a domain you own before you send nurture at any volume.
Can I send nurture from a shared domain to save time?
You can. You'll pay for it. A shared or unauthenticated domain is the most common reason careful sequences land in spam, and you can't control the reputation you share.
Why use a subdomain for marketing?
Containment. If your marketing reputation takes a hit, it can't spread to the domain that carries your invoices, client replies and password resets.
How do I know it's working?
Check that the records show as verified before you send, then watch bounce and complaint rates every month. Stable or falling is healthy. A rise is an incident to investigate.
The full method, with the checklists, is in The Email Nurture Playbook, a free 21-page playbook.
How trapped are you, really?
Take the Corporate Suffocation Index, the free solopreneur readiness assessment.