On Substack, you don't fully control how you're authenticated
SPF, DKIM and DMARC are how Gmail and Outlook confirm a message is really from who it claims to be. On a standard Substack setup your posts go out from a shared substack.com address, so this part is Substack's to manage — not yours. That's mostly good (Substack keeps it valid), but it also means you can't fix authentication yourself, and you share that sending identity with every other writer on the platform. A custom sending domain (a paid Substack feature) gives you more control. Our report just tells you pass or fail — you don't need to read a single DNS record.




