Understanding email authentication

Email authentication builds your reputation as a safe sender and keeps your emails out of the spam folder

Authenticating your outbound email verifies to your recipient's mailbox provider that the message actually came from your organization or was sent on your behalf from an authorized third party, like Constant Contact.

All email sent through Constant Contact receives basic authentication to ensure your emails get delivered to your contacts and not their spam folders. However, if you have your own domain, you can add an extra layer of authentication to further improve your email deliverability. If you don't have your own domain, don't worry! We've got you covered.

• What is email authentication?
• What are my email authentication options?

Be a better marketer: Learn more about email deliverability and best practices for improving your sender reputation.

What is email authentication?

Think of email authentication like showing your ID before entering a building. It proves your email is truly from you, helping prevent others from pretending to be you (like in spoofing and phishing scams), keeping your emails trustworthy, and protecting your organization's brand reputation. The less your emails can be confused as spam, the more likely a mailbox provider will route your emails into your contacts' inboxes rather than their spam folders.

Email is authenticated using the following standards:

• Domain Keys Identified Mail (DKIM) - This adds a digital signature to your emails. It's a way to make sure the email hasn't been altered after it was sent. To learn more about DKIM, please see DKIM.org.
• Domain-Based Message Authentication, Reporting & Conformance (DMARC) - This tells mailbox providers what to do if DKIM checks fail, such as deliver the email to the spam folder or reject it altogether. It's like having instructions for what to do if someone tries to crash the party. Learn more about DMARC. 
   

Why you don't need to add Constant Contact server addresses to an SPF record

Sender Policy Framework (SPF) is an email authentication mechanism that allows a domain to publicly state which IP addresses (email servers) are allowed to send email on its behalf. Receiving mail servers check our domain's SPF record, not yours, so you do not need to add Constant Contact IP addresses to your SPF record if you have one. To be SPF-aligned for DMARC, the visible "From" address and the "Header" or "Bounce" address must match. When sending through Constant Contact, it's not possible to pass an SPF alignment check since the "Header" or "Bounce" address is our email server address (@in.constantcontact.com), which will never match your visible "From" address.  Don't worry - there is no requirement for SPF alignment to pass a DMARC check! And when you set up self-authentication within your Constant Contact account and send from your custom domain email address, you'll be DKIM aligned for DMARC purposes.

What are my email authentication options?

When using a custom domain email address (ex: jack@jacksbackyardbbq.com)

If you have your own domain, setting up self-authentication within your Constant Contact account will allow you to send emails from your domain email address and comply with the latest authentication requirements. Sending from your own domain builds brand recognition with your customers, and by authenticating your domain, you're able to build your own sending reputation with mailbox providers under that domain, instead of sharing your reputation with all Constant Contact customers. In order to self-authenticate, you (or your IT department, if you have one) must have access to your Domain Name System (DNS) records through your domain hosting provider.

• Self-authenticate using DKIM CNAME records - This is the simplest and most secure way to authenticate your domain email address. Constant Contact generates the CNAME and DMARC record names and values you need to add to your DNS settings.
• Self-authenticate using a DKIM TXT record - This is the best option if you have multiple Constant Contact accounts using the same domain. Constant Contact generates the TXT and DMARC record names and values you need to add to your DNS settings.
  
  
  
  

When using a free webmail address (ex: jacksbackyardbbq@yahoo.com)

If you don't have your own domain and are using an email address from a free webmail provider (like Gmail, Outlook, Yahoo, etc.), or if you don't have access to your domain's DNS settings, there's nothing you need to do. We automatically rewrite your “From” email address with our shared ccsend.com domain to ensure your emails are delivered to your contacts' inboxes rather than the junk or spam folder. This lets you use our online reputation as a safe sender, meaning your sending reputation is shared in a pool with all other Constant Contact customers.  

Learn more about how your “From” email address is automatically rewritten to align with email authentication requirements and how you can customize this rewritten address to better reflect your organization.
 

Any links we provide from non-Constant Contact sites or information about non-Constant Contact products or services are provided as a courtesy and should not be construed as an endorsement by Constant Contact.

Questions?