[ Sending-service guides ]

Authenticate custom-domain email in Azure Communication Services

Identify Azure Communication Services Email as the sender, verify its custom domain, connect that domain to the application resource and test the received identities.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Separate ownership, SPF/DKIM, resource connection and application sender.
  • Check matching geography and preserve existing linked domains.
  • Treat the required SPF ending as an explicit domain-wide decision.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Treat the required SPF ending as an explicit domain-wide decision.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Connect configuration to the received message

Domain verification, resource linkage and sender selection are separate checks.

Next steps

  1. Preserve existing DNS and linked-domain settings.
  2. Verify each issued TXT and CNAME answer.
  3. Review the completed route worksheet and its unresolved rows.

CISO / SecOps

Limit the authentication change

A new application should not weaken every other sender on the domain.

Next steps

  1. Review the exact authorization and DNS owner.
  2. Keep secrets out of evidence artifacts.
  3. Require aligned SPF or DKIM proof before closure.

Founder / Non-technical

Name the actual sending service

Azure hosting alone does not identify the email dependency.

Next steps

  1. Confirm Azure Communication Services Email is the route.
  2. Choose the intended production From domain.
  3. Assign an application owner to approve the test.

[ FAQs ]

Frequently asked questions

Is this the Azure DNS setup guide?

No. This guide covers Azure Communication Services Email. Azure DNS can host its records, but DNS hosting does not configure the sending application.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Does an Azure-managed domain authenticate my brand domain?

It supplies authentication for the provided Azure-managed identity. A customer-owned sending domain follows the separate custom-domain verification workflow.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Can domain ownership verification be the final test?

No. Confirm the issued SPF and DKIM records, connect the verified domain to the correct Communication Services resource and test an actual application message.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Must the two Azure resources use the same geography?

Microsoft’s connection instructions require matching geography. Check the actual resource data locations before trying to connect the domain.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Where should I obtain DKIM selectors and targets?

Copy both DKIM and DKIM2 entries from the custom domain’s current authentication configuration. Do not reuse values from another resource or screenshot.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Can I assume the configured sender address is the SPF identity?

No. Inspect the received Return-Path and trusted receiver’s evaluated SPF domain. Keep the visible From and envelope identities separate.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Why can the API accept mail while the authentication review fails?

API acceptance concerns submission. DNS, actual signing identities, alignment and receiver handling require separate evidence from the received message.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What remains before this is a tested implementation?

The Azure product scope, tenant values, authoritative DNS captures, application-route message evidence and human SME approval remain open.

Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn Add custom verified email domains - An Azure Communication Services article | Microsoft Learn Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

[ Sources ]

Sources

  1. Email domains and sender authentication - An Azure Communication Services article | Microsoft Learn

    Sections Azure-managed versus custom domains; connection overview

  2. Add custom verified email domains - An Azure Communication Services article | Microsoft Learn

    Sections Ownership41–100; zone-relative SPF/DKIM101 onward; sender authentication

  3. Connect a verified email domain to send email - An Azure Communication Services article | Microsoft Learn

    Sections Connect domain; same geography; up to100 custom domains; PATCH linkedDomains examples

  4. Troubleshooting domain configuration issues - An Azure Communication Services concept document | Microsoft Learn

    Sections Ownership37–67; SPF68–99 (-all required); DKIM/DKIM2 100 onward

  5. https://www.rfc-editor.org/rfc/rfc7208.html

    Sections §3.2; 3.3; 4.6.4

  6. https://www.rfc-editor.org/rfc/rfc6376.html

    Sections §3.5; 3.6.2; 6.1

  7. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Email Communication Service resource
The Azure resource used to provision and validate email domains.
Communication Services resource
The application-facing Azure resource connected to verified email domains.
Azure-managed domain
An Azure-provided sending identity with preconfigured authentication.
Ownership TXT record
A public DNS token used to demonstrate control of the domain.
Received-message evidence
The original delivered message and trusted receiver results used to verify the actual route.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base