[ Sending-service guides ]

Authenticate email sent through Benchmark Email: configuration and verification

Choose the Benchmark domain-verification flow shown in your account and verify its delegation or individual-record changes without mixing generations of instructions.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Follow the account’s NS or multiple-record branch, not both.
  • Delegate only the approved unused child subdomain.
  • Shared-domain delivery does not prove private-domain readiness.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Shared-domain delivery does not prove private-domain readiness.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Keep branches separate

NS delegation and individual records are different changes.

Next steps

  1. Inspect the account workflow.
  2. Use generated record values.
  3. Check descendant DNS dependencies.

CISO / SecOps

Control delegation scope

Do not turn a child-domain setup into a whole-domain migration.

Next steps

  1. Approve the selected child.
  2. Preserve existing mail routing.
  3. Record rollback and cache considerations.

Founder / Non-technical

Approve the actual campaign identity

Fallback delivery may differ from the intended brand.

Next steps

  1. Confirm private-domain status.
  2. Review the received From address.
  3. Pause on unexplained fallback.

[ FAQs ]

Frequently asked questions

Should I follow an older two-CNAME article?

Only if it matches your actual account workflow. Do not mix it with the NS or multiple-record setup described here.

Domain Verification - Benchmark Help Center

Does the NS option move my entire domain?

The documented record delegates the chosen subdomain. Do not change the parent’s registrar nameservers for that step.

Verify Domain Using NS Record - Benchmark Help Center

Why must the subdomain be unused?

Existing services or descendant records can be affected by a new delegation or conflicting owner.

Verify Domain Using NS Record - Benchmark Help Center

Can I copy the SPF example from the prose guide?

Use the current account-generated value. The published example has an apparent spelling inconsistency that warrants confirmation.

Verify Domain Using Multiple DNS Records - Benchmark Help Center

Is the technical MX my normal inbox MX?

Not necessarily. Match the supplied subdomain owner and do not replace unrelated inbound mail routing.

Verify Domain Using Multiple DNS Records - Benchmark Help Center

What if my DNS host cannot add the required MX?

Resolve a supported option with Benchmark before using private sending; do not invent a substitute record.

Verify Domain Using Multiple DNS Records - Benchmark Help Center

Does a delivered shared-domain message prove private sending?

No. Inspect the actual identities and the private-domain verification status.

Domain Verification - Benchmark Help Center

What evidence closes setup?

The selected branch, authoritative record answers, account verification and a controlled message with the intended aligned identity.

[ Sources ]

Sources

  1. Domain Verification - Benchmark Help Center

    Sections Detect Domain Host for Domain Verification · Private Domain · Shared Domain

  2. Verify Domain Using Multiple DNS Records - Benchmark Help Center

    Sections Before getting started · Step 3: Configure · SPF · DKIM · DMARC · Link Wrapping

  3. Verify Domain Using NS Record - Benchmark Help Center

    Sections Step 2: Adding DNS Records · Step 4: Finish the Setup · Failed Status

  4. RFC 7208

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
DNS authorization for the SMTP envelope-sender domain, subject to protocol limits.
DKIM
A signature verified using a public key at a selector under the signing domain.
DMARC alignment
The required relationship between the visible From domain and a passing SPF or DKIM authentication domain.
Authoritative DNS
The delegated DNS service responsible for the published zone answers.
Selector
The DKIM identifier used with the signing domain to locate the public key.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base