Authentication tokens work by embedding a unique code within the email header or body. When the email is sent, the receiving email server checks the token against a known list of valid tokens. If the token matches, the email is considered authentic. Common authentication protocols include DKIM (DomainKeys Identified Mail), SPF (Sender Policy Framework), and DMARC (Domain-based Message Authentication, Reporting & Conformance).