[ Sending-service guides ]

Authenticate email sent through GreenRope: configuration and verification

Install GreenRope’s published SPF and DKIM configuration while preserving existing senders and verifying the selected campaign identity.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Authenticate the sender selected for the actual campaign.
  • Configure the account-specific custom MTA separately.
  • Preserve existing policy and verify received alignment.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Preserve existing policy and verify received alignment.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Preserve DNS dependencies

A shared SPF policy and occupied selector need careful handling.

Next steps

  1. Inventory existing SPF terms.
  2. Check selector conflicts.
  3. Compare account and message results.

CISO / SecOps

Keep policy authority separate

A CRM sample must not override corporate DMARC intent.

Next steps

  1. Approve report recipients.
  2. Review domain scope.
  3. Retain evidence before reducing restrictions.

Founder / Non-technical

Validate the campaign identity

The selected sender can change after DNS is configured.

Next steps

  1. Name the campaign owner.
  2. Test the release sender.
  3. Keep a pause decision available.

[ FAQs ]

Frequently asked questions

Which SPF include does GreenRope document?

Its current setup article lists include:_spf.stgi.net. Reconfirm applicability before changing the single policy at your intended owner.

Setting Up SPF, DKIM and DMARC

What DKIM record does the provider publish?

A CNAME at kesq._domainkey targeting dkim.stgi.net. Confirm the full owner under the intended sending domain.

Setting Up SPF, DKIM and DMARC

Can that CNAME coexist with an old TXT key at the same owner?

No. Establish the old record’s dependency and arrange a supported change instead of adding conflicting data.

Should I replace all SPF content with the GreenRope example?

No. Preserve other authorized senders and assess the complete lookup budget.

Does a green domain check validate every campaign sender?

No. Verify the selected sender on a controlled message from the campaign being released.

Setting Up SPF, DKIM and DMARC

Should I copy the sample DMARC reporting addresses?

No. Use an approved destination you control and reconcile the existing policy with the domain owner.

Setting Up SPF, DKIM and DMARC

How is the custom MTA configured?

In Communicate > Email, use MTA, add the approved subdomain, then setup to obtain its account-specific CNAME target. Publish and verify it separately from DKIM, and inspect actual alignment.

Setting Up SPF, DKIM and DMARC

What should happen before retrying a failed campaign?

Identify the failing layer, make a controlled correction and retain a fresh received-message authentication test.

[ Sources ]

Sources

  1. Setting Up SPF, DKIM and DMARC

    Sections DNS - SPF · DNS - DKIM · DNS - DMARC · CUSTOM MTA SETTING: account-specific CNAME, steps1–6

  2. RFC 7208

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  3. RFC 6376

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  4. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
DNS authorization for the SMTP envelope-sender domain, subject to protocol lookup limits.
DKIM
A signature verified using the public key at a selector under the signing domain.
DMARC alignment
The required relationship between the visible From domain and a passing SPF or DKIM authentication domain.
Authoritative DNS
The delegated DNS service that publishes the zone answers.
Return-Path
A message header recording the reverse-path used for delivery failure handling; inspect the envelope identity in trusted authentication results.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base