A perfectly authenticated email can still be unwanted.
That sounds obvious until the green lights start appearing in the headers.
SPF passes. DKIM passes. DMARC passes. The domain aligns correctly. The message came through TLS. Technically, the sender has done a lot right.
What those checks establish is mostly identity and authorization at the domain level.
They do not establish permission from the recipient.
Google’s current Gmail requirements make this distinction visible. Bulk senders must authenticate mail with SPF and DKIM, publish DMARC, and align the visible From domain with authenticated domains. Google separately tells senders to avoid unwanted mail, keep complaint rates low, and provide one-click unsubscribe for promotional messages. See Gmail’s email sender guidelines FAQ.
Those are separate requirements because they answer separate questions.
Authentication asks who is speaking
SPF checks whether the sending server is authorized for a domain.
DKIM verifies a cryptographic signature attached by the sending domain.
DMARC ties authentication to the domain shown to the user and lets domain owners publish handling policies for failures.
These systems are enormously useful against spoofing and impersonation.
If an attacker sends a fake bank message from infrastructure the bank never authorized, authentication can help a receiving system detect the mismatch.
But suppose the real bank sends a promotional message from its real servers using its real domain.
Authentication can correctly say: yes, this really came from the bank.
It cannot say: yes, Leo asked for this offer.
A verified nuisance is still a nuisance
This matters because sender reputation can be mistaken for recipient consent.
A large company can authenticate every message flawlessly and still mail an old address, over-message an inactive customer, misunderstand a signup, or keep sending categories of promotion the recipient no longer wants.
The inverse is also possible. A small legitimate sender can make an authentication mistake while sending mail that subscribers genuinely requested.
Identity and desirability are correlated only indirectly.
To establish permission, investigators need a different evidence trail: where the address was collected, what wording appeared beside the form, whether the person confirmed the subscription, what categories of messages were described, when the permission was recorded, and whether the person later opted out.
The FTC’s CAN-SPAM guidance also makes a useful legal distinction. U.S. federal law generally does not require prior opt-in consent for commercial email, provided the sender follows the law’s requirements and honors opt-outs. See the FTC’s Candid answers to CAN-SPAM questions.
So even lawful, authenticated, and wanted are three different properties.
Spam Empires become easier to study when those properties are not collapsed into one another.
Authentication can tell you a great deal about who sent the message.
It cannot tell you whether the human receiving it ever wanted to hear from them.