CertaDNS
Skip to lesson

Beyond Authentication · lesson 1 of 4

What authentication does not buy

After this lesson you can

Separate the delivery problems authentication fixes from the ones it cannot touch.

Assumes you have read What BIMI requires.

Perfect SPF, aligned DKIM and p=reject get a message considered. They do not get it delivered to an inbox, and the gap between those two outcomes is where most “deliverability” work actually lives.

What each side owns

Authentication decidesReputation decides
Whether the message is from who it claimsWhether that sender is welcome
Whether a DMARC policy appliesWhether it reaches the inbox or the spam folder
Whether a forged message is rejectedWhether a genuine message is throttled
A binary outcome per messageA continuous score per domain and IP, over time

Authentication is a precondition. A domain that fails it is heavily penalised; a domain that passes it has merely become eligible to be judged on everything else.

What the judgement is on

  • Complaint rate. The proportion of recipients pressing the spam button. The single most consequential number, and the only one with a published threshold.
  • Invalid addresses. Sending to addresses that do not exist signals a list that was not collected properly.
  • Engagement. Opens, replies, and messages moved out of spam. Absence of engagement across a large volume reads as unwanted mail.
  • Volume consistency. A domain that sends two hundred messages a day and then four hundred thousand looks compromised, because sometimes it is.
  • Spam-trap hits. Addresses that exist only to catch senders using harvested or very old lists.
  • Infrastructure hygiene. Reverse DNS, HELO names, TLS support — small signals, each worth little, collectively expected.

Why this belongs in this course

Because the question that follows a completed authentication programme is always “we did all that and mail still goes to spam”, and the honest answer is that those are different problems with different owners. Authentication is a DNS and configuration exercise you can finish. Reputation is a property of how you send, it cannot be finished, and no record you publish will substitute for it.

Nobody can whitelist you

Services offering inbox placement, deliverability guarantees or a relationship with the major providers are selling something that does not exist as a product. Reputation is computed from behaviour. The levers are list quality, complaint rate and sending consistency, and they are all yours.

Try it on a real domain

Free, no account, public DNS only.

Last reviewed