[ Sending-service guides ]

Authenticate mxHERO mail according to its routing architecture

Choose direct delivery or platform relay deliberately, then verify re-signing, SPF and the receiver’s treatment of ARC.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Choose direct delivery versus final-platform relay before DNS changes.
  • Verify the final signer after intended content transformation.
  • Preserve loop-prevention and ARC trust boundaries.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Preserve loop-prevention and ARC trust boundaries.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the final signature

A pre-processing signature may not survive content changes.

Next steps

  1. Publish the account-generated key.
  2. Test every materially different route and alias.
  3. Retain the evidence and explicit release approval.

CISO / SecOps

Review ARC and connector trust

An intermediary trust change affects more than DNS syntax.

Next steps

  1. Preserve existing trusted-sealer lists.
  2. Approve security changes separately from documentary review.
  3. Retain the evidence and explicit release approval.

Founder / Non-technical

Choose the architecture deliberately

Direct delivery and platform relay have different signing owners.

Next steps

  1. Approve the intended routing map.
  2. Pilot the exact content transformations.
  3. Retain the evidence and explicit release approval.

[ FAQs ]

Frequently asked questions

Why can DKIM fail after mxHERO processing?

Changes to covered message content can invalidate a signature made earlier in the path.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

Which SPF include does the guide specify?

It specifies include:_spf.mxhero.com for the documented delivery path; retain the underscore and merge with existing permissions.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

When is mxHERO signing needed?

The guide describes it for direct outbound delivery. A relay-back architecture can use final-platform signing; confirm the actual route.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

Does publishing the DKIM record start signing immediately?

The guide requires provider verification to succeed before mxHERO begins signing for that domain.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

Can I invent the next rotation selector?

No. Use the generated selector and public key from the supported setup process.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

Does ARC guarantee acceptance?

No. Receiver policy determines how prior authentication evidence is used; ARC is not a universal delivery guarantee.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

Should I overwrite the Microsoft trusted-sealer list?

No. Inspect and preserve existing entries and obtain approval for the security-sensitive change.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

What is a meaningful test?

A controlled message through the intended transformation and final delivery route, with trusted results and an aligned passing identity.

mxHERO SPF DKIM and DMARC mxHERO routing architectures mxHERO testing mail flow RFC 7208 Sender Policy Framework RFC 6376 DKIM signatures RFC 9989 DMARC

[ Sources ]

Sources

  1. mxHERO SPF DKIM and DMARC

    Sections What changes; SPF include; signing verification; rotate/remove; trusted ARC sealer

  2. mxHERO routing architectures

    Sections Key terms; four architectures; loop prevention; why Server matters

  3. mxHERO testing mail flow

    Sections Steps1–5 test users, headers, logs; troubleshooting

  4. RFC 7208 Sender Policy Framework

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM signatures

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Envelope domain
The domain in the SMTP MAIL FROM identity used in the ordinary SPF evaluation.
DKIM selector
The identifier that locates a signing domain public key in DNS.
Alignment
The relationship required between an authenticated domain and the visible From domain for DMARC.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base