[ Sending-service guides ]

Authenticate email sent through JangoMail: configuration and verification

Choose JangoMail’s system or advanced DKIM method, enable it after DNS publication and verify the real envelope identity.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Keep campaign delivery reversible
  • Separate the two key methods
  • Review signing and envelope trust
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Choose JangoMail’s system or advanced DKIM method, enable it after DNS publication and verify the real envelope identity.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Separate the two key methods

Mail admin: CNAME system keys and TXT advanced keys require different publication steps.

Next steps

  1. Choose the account-supported method.
  2. Publish the exact record and enable signing.
  3. Inspect the envelope on each sending route.

CISO / SecOps

Review signing and envelope trust

CISO: SPF permission, DKIM signing and DMARC enforcement are distinct controls.

Next steps

  1. Limit authorization to active services.
  2. Review selector retirement and key rotation.
  3. Require aligned receiver evidence before policy changes.

Founder / Non-technical

Keep campaign delivery reversible

Founder: A key change can affect scheduled customer communications.

Next steps

  1. Name the account owner.
  2. Keep a verified sender during rollout.
  3. Approve expansion after campaign and application tests.

[ FAQs ]

Frequently asked questions

Should I publish both CNAME and TXT at jm._domainkey?

No. Choose the applicable DKIM method and resolve any existing record conflict before publishing.

Create a System DKIM Create your own DKIM (Advanced)

Does adding the DNS record switch on signing?

The documented workflows also require returning to JangoMail and using Enable after publication.

Create a System DKIM Create your own DKIM (Advanced)

Why does the system article mention TXT after describing CNAME?

That wording is inconsistent. Its system-key publication steps explicitly specify CNAME; confirm current account instructions rather than adding another record.

Create a System DKIM

Is DKIM encrypting my messages?

No. DKIM signs selected message content for validation; it does not provide confidentiality.

RFC 6376 DKIM

Which SPF mechanism does JangoMail document?

It documents include:jangomail.com. Reconcile it with the existing policy at the applicable domain and verify the actual envelope.

SPF Record

Can I set Return-Path by inserting a normal message header?

Do not use that shortcut. JangoMail documents campaign, API and relay controls for the envelope-sender address.

Custom Return-Path Header

Does a passing campaign test cover my SMTP relay application?

No. Test the relay route and its effective envelope and signing identities separately.

Custom Return-Path Header

What requires current confirmation?

The account’s selected key method, activation behavior, published DNS, real-message results and any rotation plan still require tenant and SME verification.

[ Sources ]

Sources

  1. JangoMail Account Setup

    Sections DNS Records

  2. Create a System DKIM

    Sections How to set up a System DKIM Record

  3. Create your own DKIM (Advanced)

    Sections How to Set Up a DKIM Record · How do I know everything is working?

  4. SPF Record

    Sections Publishing SPF Records with JangoMail · Condition 1 · Condition 2

  5. Custom Return-Path Header

    Sections How to Set Custom Return-Path Header via API · How to Set Custom Return-Path Header via SMTP Relay · How to Set Custom Return-Path Header in the User Interface · Notes

  6. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  7. RFC 6376 DKIM

    Sections §3.5 · §6

  8. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

System DKIM
JangoMail’s documented CNAME-based method for referencing its signing key.
Advanced DKIM
JangoMail’s documented method for publishing the generated public key directly as TXT.
Selector
A DKIM identifier that locates the public key within the signing domain.
Envelope sender
The SMTP reverse-path identity used for delivery failures and SPF evaluation.
DMARC alignment
The required relationship between the visible From domain and a passing authentication domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base