[ Sending-service guides ]

Authenticate email sent through Abnormal Security: configuration and verification

Scope Abnormal Security authentication to the current Abnormal AI Phishing Coach custom-sender feature and verify generated records without inventing portal steps.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Confirm AI Phishing Coach eligibility separately from inbound protection.
  • Approve training audiences separately from domain authentication.
  • Use portal records and verify a harmless received test.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Use portal records and verify a harmless received test.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Treat generated DNS, portal verification and received headers as separate evidence.

Next steps

  1. Obtain the current tenant-specific setup guide.
  2. Compare generated records, verification status and receiver results.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Keep exercise authorization and filtering exceptions separate from domain authentication.

Next steps

  1. Review any proposed mail-filter exceptions separately.
  2. Protect private keys and prohibit credential collection in configuration tests.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Approve the intended training identity and rollout scope before employees receive messages.

Next steps

  1. Approve the custom sender identity and awareness-program scope.
  2. Separate a harmless configuration test from employee simulations.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Is Abnormal Security the current product name?

The company rebranded to Abnormal AI. This guide maps the old catalogue identity to the documented AI Phishing Coach sender feature.

Abnormal Security becomes Abnormal AI

Does deploying inbound protection authenticate my custom outbound sender?

Do not assume that. Establish the exact feature and its generated sending-domain configuration.

Abnormal AI custom sender release 4 November 2026

Where do the DNS values come from?

From the current custom-sender workflow in your tenant, not a generic include or another customer’s selector.

Abnormal AI custom sender release 4 November 2026

Are exact portal menus verified here?

No. The public release confirms the capability, but the linked detailed support page was not readable in this review.

Abnormal AI custom sender release 4 November 2026

Can I replace an existing DMARC policy with the wizard suggestion?

Only after reviewing the existing policy and approving that separate change. Avoid duplicate records.

What does a successful test need to show?

The intended visible sender plus trusted receiver authentication and at least one aligned passing path.

Should authentication setup include broad allowlisting?

No. Authentication and mail-security exceptions are separate decisions with different risks.

When should DNS records be removed?

After the feature no longer sends or has queued communications using them, and after checking shared dependencies.

[ Sources ]

Sources

  1. Abnormal Security becomes Abnormal AI

    Sections §16 April 2025 rebrand announcement

  2. Abnormal AI custom sender release 4 November 2026

    Sections §4 November 2026 custom-sender release: capabilities and generated records

  3. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  5. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  6. RFC 1034 DNS concepts

    Sections §3.6.2 Aliases and canonical names · §4.2 How the database is divided into zones

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base