UnetEmail as originally designed does not verify the sender — technically, any server can send mail in any domain’s name. Phishing and fraud exploit exactly that gap. SPF, DKIM and DMARC are the three authentication standards that close it. They are records added to your domain’s DNS that prove to receiving servers a message really came from you.
These standards also directly affect deliverability: since 2024, Gmail and Yahoo require proper authentication for bulk senders. Mail from domains without these records lands in spam more often — or is rejected outright.
SPF — who may send?
SPF (Sender Policy Framework) is a list stored in your domain’s DNS: “only these servers may send mail in this domain’s name.” When a message arrives, the receiving server checks whether the sending server is on that list. If not, the message is treated as suspicious.
SPF’s weakness: it only checks the “envelope” address, and forwarding can break the check. That is why SPF alone is not enough.
DKIM — was the message altered?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The signature’s public key is published in your domain’s DNS. By verifying the signature, the receiving server confirms two things: the message was sent from your domain with authorization, and its content was not altered in transit.
DKIM also survives forwarding — the signature travels inside the message itself, so unlike SPF it does not break when mail is relayed.
DMARC — what to do on failure?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer on top of the other two. It tells receiving servers what to do with a message that fails SPF or DKIM checks: do nothing (none), send it to spam (quarantine), or reject it (reject).
DMARC also provides reporting: receiving servers send you statistics about mail sent in your domain’s name, so you can see who is trying to impersonate you.
Why you need all three together
SPF verifies the sending server, DKIM verifies the message’s integrity, and DMARC sets the decision policy and reporting on top of those checks. Together they make forging mail in your domain’s name practically impossible and significantly raise the odds of your own mail reaching the inbox.
How is this set up on Umail?
On Umail — the Azerbaijani email platform by Unet — the SPF and DKIM records are generated automatically when you connect your domain and shown ready to copy into your DNS panel. Your corporate email runs with modern authentication standards from day one.