Does your ESP automatically authenticate all domains?

Here's a question worth pausing on before you hit send on your next campaign: does your ESP actually authenticate your domain for you, or did it just hand you a list of DNS records and wave you off?

The short answer is no, most ESPs don't automatically handle authentication for custom sending domains. They give you the records you need, but it's on you to add them to your DNS. And until you do, your emails are going out without proper SPF, DKIM, or DMARC coverage.

That said, not every ESP works the same way. Here's roughly how the landscape breaks down:

• Some ESPs send from their own domain by default. If you're using a shared domain like via mailchimp.com, the ESP's own authentication covers you. It's not ideal for brand trust, but technically you're authenticated.
• Most require you to set up a custom sending domain. Mailchimp, Klaviyo, Brevo, Twilio SendGrid, Postmark and others all require you to add DNS records (usually DKIM CNAME records, sometimes SPF includes) before your custom domain is properly authenticated.
• A few enterprise tools do more of the heavy lifting. Platforms like Salesforce Marketing Cloud or HubSpot often have onboarding specialists who walk through authentication setup with you. But you still need someone with DNS access to actually publish the records.

So how do you actually verify whether your domain is authenticated? A few quick checks:

1. Send a test email to a Gmail address and open the original message source. In Gmail, click the three dots, choose "Show original". Look for dkim=pass, spf=pass, and dmarc=pass in the authentication results header. If any of those say fail or none, there's work to do.
2. Use a dedicated checker. You can run your domain through our free SPF checker or DKIM lookup to see what's actually published in your DNS right now.
3. Check your ESP's domain authentication dashboard. Most modern ESPs have a section that shows whether your domain records are verified. Green checkmarks are a good sign. A pending or failed status means the DNS records haven't propagated or weren't added correctly.

One thing people often miss: even if SPF and DKIM are passing, DMARC is a separate record you need to set up yourself. Your ESP almost certainly won't do that part for you. And without DMARC, you're missing a critical layer that Gmail and Yahoo Mail now require for bulk senders.

Don't assume it's all working just because you finished the setup wizard. Always verify. The email header check takes about two minutes and tells you everything you need to know.

If you're not sure what you're looking at in those headers, our free Email Header Analyzer breaks it down in plain language. Or if you'd rather just talk through your setup, our SOS hotline is free and we actually pick up ;)