[ Sending-service guides ]

Authenticate NetSuite production email with the current two-CNAME DKIM setup

Use generated CNAME records, preserve migration safeguards and verify the actual From identity, DKIM result and reply workflow.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Use both account-generated CNAMEs and retain legacy TXT during migration.
  • One currently active key behind two aliases is expected.
  • Inspect actual From rewriting and test replies separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Inspect actual From rewriting and test replies separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Follow the 2024.1-plus DKIM model

NetSuite generates two CNAME records and manages rotation.

Next steps

  1. Copy both rows from Show DNS Info without inventing selectors.
  2. Retain existing TXT records during the documented migration.
  3. Record Status, Details and fresh received-message identities.

CISO / SecOps

Treat DNS delegation as a managed signing relationship

One active key behind two CNAMEs is documented behaviour, not evidence to delete the other.

Next steps

  1. Record which account supplied the DNS targets.
  2. Keep production and non-production evidence separate.
  3. Require authoritative DNS, alignment proof and human approval.

Founder / Non-technical

Keep invoices recognizable and dependable

A familiar display name can conceal a service-rewritten From address.

Next steps

  1. List production workflows and intended brand domains.
  2. Assign NetSuite and DNS owners for the same change.
  3. Accept only after the business workflow and replies are tested.

[ FAQs ]

Frequently asked questions

Should I generate a selector and public TXT key using an old guide?

Not for the current documented workflow. Since 2024.1, NetSuite generates information for two DNS CNAME records and manages key rotation.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Where do I obtain the two CNAME rows?

Open Email Preferences, the Email Domains (DKIM) subtab and the relevant domain, then Show DNS Info. Use the generated rows for that domain.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Why does only one CNAME have an active DKIM key behind it?

Oracle documents that as expected behaviour. Preserve both records and test the selector present in the actual received message.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Should an existing TXT key be removed when adding CNAMEs?

Oracle’s current FAQ says not to delete it during this migration. Add the generated CNAMEs and retain the existing record.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

What if Pending Verification lasts more than 24 hours?

Oracle advises contacting NetSuite support after that interval following publication. First preserve authoritative answers, publication time and the Details message.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Why does the message show system@sent-via.netsuite.com?

NetSuite documents default From rewriting when DKIM setup is incomplete. Inspect the real header address rather than relying on the original address displayed as a name.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Does a production DKIM setup prove the sandbox is configured?

No. Oracle says keys are not copied to non-production accounts. Inspect that account’s settings and recipient restrictions separately.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

Is reply capture the same authentication test as an outbound invoice?

No. Capture Email Replies involves incoming messages being recorded and forwarded. Test that path separately from account-originated outbound mail.

NetSuite: DomainKeys Identified Mail (DKIM) NetSuite: Email Domains (DKIM) Preferences NetSuite: Set Up CNAME Records in DNS NetSuite: Email Domains (DKIM) FAQ NetSuite: Email Domains (DKIM) Status Column NetSuite: FROM Headers in Email Can Be Rewritten NetSuite: DMARC-Compliant Messaging in NetSuite RFC 9989 DMARC

[ Sources ]

Sources

  1. NetSuite: DomainKeys Identified Mail (DKIM)

    Sections §2024.1 change8–10; access13–15; nonproduction40

  2. NetSuite: Email Domains (DKIM) Preferences

    Sections Email preferences3–15

  3. NetSuite: Set Up CNAME Records in DNS

    Sections Show DNS Info23–39; two aliases36; status45

  4. NetSuite: Email Domains (DKIM) FAQ

    Sections Migration Ready warning17; retain TXT21; one active target24

  5. NetSuite: Email Domains (DKIM) Status Column

    Sections Status5–13; support after24hours10

  6. NetSuite: FROM Headers in Email Can Be Rewritten

    Sections From rewriting3–13

  7. NetSuite: DMARC-Compliant Messaging in NetSuite

    Sections Capture Email Replies19; inbound versus outbound35; protocol simplifications not adopted

  8. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

CNAME delegation
A DNS alias that lets the target service supply the referenced key data.
From rewriting
Changing the actual From address, sometimes retaining the original address only in its display string.
Ready status
NetSuite’s domain-verification state, distinct from an independently observed business-workflow test.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base