[ Sending-service guides ]
Authenticate email sent through Survalyzer: configuration and verification
Configure Survalyzer using its documented workflow, then verify DNS, received-message identities and recovery readiness. Live validation remains pending.
By the EmailAuth research team · 4 min read
[ Key points ]
- Match the DKIM key to the account data center.
- Keep sula MAIL FROM records separate from receiving mail.
- Obtain provider activation after DNS publication.
[ Takeaway ]
Obtain provider activation after DNS publication.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Reconcile the account and DNS
Apply the Survalyzer instructions above to the exact account and authoritative zone.
Next steps
- Match the DKIM key to the account data center.
- Publish the supplied values without overwriting unrelated senders.
- Retain raw test headers and authoritative answers.
CISO / SecOps
Require aligned evidence
Review Survalyzer as one dependency in the whole domain’s authentication policy.
Next steps
- Keep sula MAIL FROM records separate from receiving mail.
- Confirm trusted receiver results and identity alignment.
- Keep live validation and human approval as explicit release gates.
Founder / Non-technical
Own the customer-facing outcome
For Survalyzer, brand consistency depends on the actual sending route, not just a successful DNS save.
Next steps
- Obtain provider activation after DNS publication.
- Keep an owner for fallback and service continuity.
- Require evidence before declaring rollout complete.
[ FAQs ]
Frequently asked questions
Is a particular package required?
The retained guide specifies the Corporate Package.
How do I choose the DKIM key?
Match the account hostname’s EU or Swiss region to the provider’s corresponding key.
Do both regions use the same key?
No. The guide shows different public keys at the same survalyzer2._domainkey owner.
Where does MAIL FROM SPF belong?
At the documented sula subdomain, not automatically at the main domain apex.
Should the main receiving MX be changed?
No. The documented MX is for the custom MAIL FROM subdomain.
Can I derive a Swiss MAIL FROM endpoint?
Do not invent one. The retained guide shows the EU-central endpoint; confirm the account route with Survalyzer.
Is p=none an enforcement policy?
It is monitoring, not a request to quarantine or reject failures.
Is DNS publication the last step?
No. Notify Survalyzer for its account update and verify an actual invitation afterward.
[ Sources ]
Sources
- Survalyzer: Configure a custom email sender domain (German)
Sections Corporate Package prerequisite · Schritt2: EU and Swiss DKIM; Custom MAIL FROM; DMARC · Schritt3: provider account update
- Survalyzer: Custom survey domain
Sections Corporate Package; domain consistency · Step2: separate web-domain records · Step3: certificate process
- RFC 7208: SPF
Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits
- RFC 6376: DKIM
Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions
- RFC 9989: DMARC
Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail
[ Glossary ]
Glossary
- SPF
- Authorization of sending hosts for the SMTP envelope identity; a pass alone does not prove visible From alignment.
- DKIM
- A signature verified using a public key under the signing domain and selector.
- DMARC
- Evaluation of the visible From domain against aligned SPF or DKIM authentication and the domain policy.
- Authoritative DNS
- The name servers responsible for publishing the zone’s records.
- Return-Path
- A delivered-message trace of the SMTP envelope reverse path, distinct from the visible From address.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption