[ Sending-service guides ]

Authenticate email sent through Inxmail: configuration and verification

Choose the correct Inxmail domain model, publish its generated records and verify the actual campaign or transactional route.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Choose a sustainable domain model
  • Publish the generated scenario
  • Define delegation responsibilities
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Choose the correct Inxmail domain model, publish its generated records and verify the actual campaign or transactional route.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Publish the generated scenario

Mail admin: Records and configuration depend on the Inxmail product and selected domain model.

Next steps

  1. Register the domain before DNS publication.
  2. Review every generated owner and target.
  3. Test each campaign or transactional route.

CISO / SecOps

Define delegation responsibilities

CISO: Delegated DNS changes who operates authentication controls.

Next steps

  1. Review existing uses of the namespace.
  2. Assign DMARC policy and offboarding ownership.
  3. Require trusted receiver evidence before sign-off.

Founder / Non-technical

Choose a sustainable domain model

Founder: Domain ownership affects the cost and risk of future campaigns.

Next steps

  1. Name the business owner.
  2. Approve a dedicated namespace or an existing-domain exception.
  3. Keep the previous sender during rollout.

[ FAQs ]

Frequently asked questions

Must the sending domain exist in Inxmail before I publish DNS?

Yes. Inxmail explicitly requires registering it first, then adding the records generated for that scenario.

Set up your sending domain

Can I use a domain that also handles ordinary business mail?

The documented main-domain or subdomain alias option covers that case. Review its wider impact and do not use an exclusive-domain model blindly.

Choose the right scenario

Is there one SPF or DKIM template for every Inxmail account?

No universal template is established here. Copy the record set displayed for the configured domain and scenario.

Who maintains DNS when I do not delegate the domain?

Your organization remains responsible for ongoing maintenance, including its DMARC policy.

Add DNS records

Does Ready status prove that every campaign is aligned?

No. The actual campaign still needs the correct From domain and a receiving-system authentication test.

Use your domain as the sender address

Are branded tracking links the same as DMARC alignment?

No. Inxmail uses a broader Full Domain Alignment concept, while DMARC evaluates authenticated email identities against the visible From.

Use your domain as the sender address RFC 9989 DMARC

Should I remove the old sender immediately?

Keep the approved working route until the replacement passes identity, reply and link tests.

What must a reviewer still verify?

The tenant-specific model and records, live DNS, actual message results, maintenance ownership and current product behavior need review.

[ Sources ]

Sources

  1. Choose the right scenario

    Sections Subdomain with delegation · Subdomain via alias · Main domain or subdomain via alias

  2. Set up your sending domain

    Sections Step by step · Subdomain with delegation · Main domain or subdomain via alias

  3. Add DNS records

    Sections Initial setup · Ongoing maintenance

  4. Use your domain as the sender address

    Sections Which statuses are available? · Newsletters & campaigns · Transactional mails · Inxmail Professional

  5. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  6. RFC 6376 DKIM

    Sections §3.5 · §6

  7. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Domain delegation
Assigning operation of a DNS namespace to another DNS service.
Bounce domain
The domain used in the SMTP envelope identity for delivery failures.
DKIM selector
The s= value locating the signing key beneath a domain’s _domainkey namespace.
DMARC alignment
The relationship required between the visible From domain and a passing SPF or DKIM domain.
Authoritative DNS
The service publishing the definitive records for a DNS zone.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base