Here is the trap with rotating across providers: every email says it is from your domain, so every provider in the pool must be authorised to send for that domain (DKIM or SPF). An unauthorised provider fails DMARC on every email it sends, which hurts the very reputation rotation is meant to protect.
The Send Rotation and Warmup panel shows an authentication badge for each connection:
- Green with a tick: your sending domain's DNS proves this provider is authorised, through a DKIM record or your SPF record.
- Amber with a question mark: DNS could not confirm it. This does not mean it is broken. Several providers use per-account selector names no checker can guess, so if the provider's own dashboard shows your domain verified, you are fine.
Strict DKIM guard: tick this and only green connections take part in rotation. Amber ones are not dropped, they simply move to the failover tail, so no email is ever lost to the guard. Leave strict mode off if your providers verify domains their own way and their dashboards show green.
Use the Re-check authentication button after changing DNS records. Results are cached for 12 hours otherwise.
Setting up authentication itself is covered in the Deliverability guide: SPF, DKIM and DMARC. Do that once per provider and rotation becomes pure upside.