[ Sending-service guides ]

Authenticate MODX Cloud mail by choosing and verifying the actual sending route

Separate MODX Cloud local delivery from a connected email service, then test the identities actually used by the application.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Choose a dependable notification route
  • Trace the real mailer
  • Control application signing keys
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate MODX Cloud local delivery from a connected email service, then test the identities actually used by the application.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Trace the real mailer

Different MODX contexts can use different transports.

Next steps

  1. Record the actual envelope and signing identities.
  2. Test each production workflow separately.
  3. Retain the evidence and explicit release approval.

CISO / SecOps

Control application signing keys

CMS configuration is not evidence of universal tenant support.

Next steps

  1. Assign key custody and rotation.
  2. Require received-message proof before acceptance.
  3. Retain the evidence and explicit release approval.

Founder / Non-technical

Choose a dependable notification route

Website hosting and email delivery are different dependencies.

Next steps

  1. Identify critical transactional flows.
  2. Approve the sending architecture before DNS changes.
  3. Retain the evidence and explicit release approval.

[ FAQs ]

Frequently asked questions

Does MODX Cloud hosting mean MODX sends the email?

No. The application may submit to a separate SMTP provider or ESP; inspect the configured transport.

Email in MODX Cloud overview

Will SPF open port 25?

No. DNS authorization does not change the platform network restriction or account email enablement.

Email in MODX Cloud overview

Should every site add a MODX include?

No universal include is established by the retrieved documentation. Its example uses a; validate applicability to the real sending IP.

MODX Cloud SPF records

Is the a mechanism always appropriate?

No. Its address resolution must cover the actual outbound IP without granting unnecessary authorization.

MODX Cloud SPF records RFC 7208 Sender Policy Framework

Does MODX support DKIM settings?

The selector-settings source returned HTTP403 in this review, so current application-managed signing is not established by this package. Obtain matching installed-version and mail-path documentation before selecting that route.

Can I use a visitor address as From?

Avoid that design. Use an authorized organizational From identity and a suitable reply address for the visitor.

RFC 9989 DMARC

What establishes DMARC success?

A trusted receiver result with a passing aligned SPF or DKIM identity for the actual workflow, not DNS alone.

RFC 9989 DMARC

What remains open?

Transport-specific tenant capability, live DNS and message tests, visual review and human SME approval.

[ Sources ]

Sources

  1. Email in MODX Cloud overview

    Sections Tech Note on Port 25 · Maximize Email Delivery in MODX Cloud

  2. MODX Cloud SPF records

    Sections Managing SPF Records · Adding MODX Cloud to an existing SPF record

  3. RFC 7208 Sender Policy Framework

    Sections §4.5 Selecting Records · §4.6.4 DNS Lookup Limits

  4. RFC 6376 DKIM signatures

    Sections §3.5 The DKIM-Signature Header Field · §6 Verifier Actions

  5. RFC 9989 DMARC

    Sections Identifier alignment · Policy discovery

[ Glossary ]

Glossary

Envelope domain
The domain in the SMTP MAIL FROM identity used in the ordinary SPF evaluation.
DKIM selector
The identifier that locates a signing domain public key in DNS.
Alignment
The relationship required between an authenticated domain and the visible From domain for DMARC.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base