[ Sending-service guides ]

Authenticate email sent through Stackmail: configuration and verification

Configure Stackmail using its documented workflow, then verify DNS, received-message identities and recovery readiness. Live validation remains pending.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Check for automatically created SPF before adding records.
  • Immediate signing makes external DNS readiness important.
  • Separate mailbox submission from application routes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate mailbox submission from application routes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Reconcile the account and DNS

Apply the Stackmail instructions above to the exact account and authoritative zone.

Next steps

  1. Check for automatically created SPF before adding records.
  2. Publish the supplied values without overwriting unrelated senders.
  3. Retain raw test headers and authoritative answers.

CISO / SecOps

Require aligned evidence

Review Stackmail as one dependency in the whole domain’s authentication policy.

Next steps

  1. Immediate signing makes external DNS readiness important.
  2. Confirm trusted receiver results and identity alignment.
  3. Keep live validation and human approval as explicit release gates.

Founder / Non-technical

Own the customer-facing outcome

For Stackmail, brand consistency depends on the actual sending route, not just a successful DNS save.

Next steps

  1. Separate mailbox submission from application routes.
  2. Keep an owner for fallback and service continuity.
  3. Require evidence before declaring rollout complete.

[ FAQs ]

Frequently asked questions

Who documents Stackmail SPF?

20i documents it, including the spf.stackmail.com include.

20i: SPF records

Could SPF already exist?

Yes. Newly provisioned packages receive it automatically unless the preference opts out.

20i: SPF records

What is the manual root Name value?

The 20i manual SPF guide says to leave Name blank.

20i: SPF records

Should I paste the baseline over a mixed policy?

No. Inventory other senders and merge authorization into one policy.

20i: SPF records

Where do I enable DKIM?

Manage Hosting, manage the package, DomainKeys, choose the domain, then Add Signature with a selector.

20i: Add a DKIM record

Will DKIM DNS always be automatic?

20i promises automatic publication when nameservers are with 20i. External DNS needs separate publication.

20i: Add a DKIM record

When does signing start?

The guide says immediately for mailboxes under the selected domain, so verify DNS readiness.

20i: Add a DKIM record

Does one mailbox test cover website scripts?

No. Test distinct outbound routes independently.

[ Sources ]

Sources

  1. 20i: SPF records

    Sections How to add SPF records automatically · How to add SPF records manually

  2. 20i: Add a DKIM record

    Sections How to add a DKIM record at 20i · Immediate signing and conditional automatic DNS

  3. RFC 7208: SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376: DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  5. RFC 9989: DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
Authorization of sending hosts for the SMTP envelope identity; a pass alone does not prove visible From alignment.
DKIM
A signature verified using a public key under the signing domain and selector.
DMARC
Evaluation of the visible From domain against aligned SPF or DKIM authentication and the domain policy.
Authoritative DNS
The name servers responsible for publishing the zone’s records.
Return-Path
A delivered-message trace of the SMTP envelope reverse path, distinct from the visible From address.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base