[ Sending-service guides ]

Authenticate email sent through Mailrelay: configuration and verification

Authenticate the Mailrelay newsletter route with its documented SPF permission and DKIM delegation, keep tracking branding separate, and verify a controlled received message.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Preserve existing SPF authorization and use the documented DKIM delegation.
  • Distinguish tracking branding from the separately enabled SMTP bounce feature.
  • Verify actual Return-Path and aligned authentication per route.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify actual Return-Path and aligned authentication per route.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Separate DNS by purpose

SPF authorization, the DKIM selector and tracking aliases serve different functions.

Next steps

  1. Merge SPF without removing other senders.
  2. Verify the selector owner and CNAME target.
  3. Capture the actual received identities.

CISO / SecOps

Preserve enforcement during repair

An isolated sending problem should not become a whole-domain protection downgrade.

Next steps

  1. Review the applicable DMARC policy.
  2. Keep sanitized evidence in restricted storage.
  3. Retain the original-message and SME approval gates.

Founder / Non-technical

Keep the campaign launch conditional

A setup check does not prove that the intended campaign preserves the brand identity.

Next steps

  1. Name the campaign and DNS owners.
  2. Approve a controlled recipient test.
  3. Require evidence before releasing the production audience.

[ FAQs ]

Frequently asked questions

Which Mailrelay product does this guide cover?

The mailrelay.com email-marketing service documented with ipzmarketing.com authentication, not every service called a mail relay.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Which SPF include does Mailrelay document?

The provider documents include:spf.ipzmarketing.com. Merge it into the applicable existing policy after confirming the current account instructions.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What is the documented DKIM delegation?

Mailrelay documents ipz._domainkey at the sending domain as a CNAME to dkim.ipzmarketing.com. Confirm the complete DNS owner and target for the actual deployment.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does the custom tracking domain prove SPF alignment?

No. Link branding alone is not alignment evidence. The updated provider guide separately documents enabling asynchronous bounce to use the custom domain as Return-Path for SMTP mail. Verify that setting and the actual SMTP message; do not infer identical behavior for every newsletter or API route.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I replace my enforced DMARC policy with the example?

No. Review the existing domain-wide policy and other senders rather than weakening enforcement to match a generic example.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What if the authentication panel is green but DMARC fails?

Inspect the actual campaign From, receiver-evaluated SPF identity and every successful DKIM domain for alignment.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does a newsletter test verify a transactional integration?

No. Obtain a controlled received message from each production route and compare its identities.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What remains required before approval?

A completed original received-message identity table for the exact route, relevant FAQ review and human mail-security SME approval.

Set your sender. Configuring SPF, custom domain, DKIM and DMARC How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Set your sender. Configuring SPF, custom domain, DKIM and DMARC

    Sections Step 1: SPF; Step 2: Custom domain; Step 3: DKIM; Step 4: DMARC

  2. How to set up SPF, DKIM, DMARC and a custom domain in Mailrelay, step by step

    Sections Step 2 / How to add it in Mailrelay: Tracking and bounce domains, Verify, Enable asynchronous bounce, SMTP Return-Path; How to check everything is correct

  3. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  4. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  5. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

ipz selector
The selector label in Mailrelay’s documented DKIM CNAME configuration.
Tracking custom domain
A customer hostname used for Mailrelay links and images.
Authentication panel
Mailrelay’s domain configuration check under Settings > Email authentication.
Route identity table
The original test record connecting a specific sending workflow with received authentication identities.
Aligned path
A passing SPF or DKIM result whose domain satisfies the DMARC comparison with the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base