[ Sending-service guides ]

Authenticate email sent through MailerLite: configuration and verification

Authenticate the MailerLite sending domain, configure its separate alignment subdomain when needed, and verify actual message identities without breaking links in earlier campaigns.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Separate current MailerLite authentication from optional alignment.
  • Preserve dedicated subdomain and existing campaign links.
  • Test actual campaign identities, replies and tracking separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test actual campaign identities, replies and tracking separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Separate the two DNS flows

Authentication and optional alignment publish different records and require separate checks.

Next steps

  1. Use the current product's account-issued records.
  2. Reserve a dedicated alignment subdomain.
  3. Inspect real From, Return-Path and DKIM identities.

CISO / SecOps

Keep policy ownership clear

A marketing-domain change can interact with organization-wide DMARC and DNS access.

Next steps

  1. Review automatic DNS authorization.
  2. Do not weaken existing DMARC without evidence.
  3. Retire tracking and signing trust only after dependency review.

Founder / Non-technical

Protect earlier campaigns

Alignment changes can affect links in email that customers already received.

Next steps

  1. Inventory active campaigns and automations.
  2. Keep historical links in the recovery plan.
  3. Approve a controlled test before broad sending.

[ FAQs ]

Frequently asked questions

Does this workflow apply to MailerLite Classic?

The cited pages are for current MailerLite and direct Legacy (Classic) users to a separate help center. Confirm the product first.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Which records authenticate the current sending domain?

The manual workflow supplies a DKIM CNAME, SPF TXT and verification TXT. Use the values generated for the actual account and domain.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is MailerLite domain alignment the same as domain authentication?

No. It is a separate optional setup after authentication, with a dedicated subdomain and its own A, MX and TXT records.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should the alignment subdomain become the visible From domain?

MailerLite says not to use it as the sender domain. Keep the intended sending address and verify the actual message identities.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I share that subdomain with a landing page?

No. MailerLite warns that reusing one subdomain for alignment and website or landing-page hosting causes conflicts.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does branded tracking prove DMARC alignment?

No. DMARC evaluates the visible From domain against passing SPF and DKIM identities, not tracking links.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I disable alignment to roll back a change?

Not casually. MailerLite warns that links in previously sent campaigns stop working when alignment is disabled. Include historical links in the recovery plan.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What is required after the domain says Authenticated?

A received-message identity table from every covered campaign or automation route, plus separate reply and tracking checks where applicable. Live evidence and human review are still pending.

Domain authentication - MailerLite How To Align Your Domain - MailerLite Troubleshooting: Domain authentication - MailerLite RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Domain authentication - MailerLite

    Sections Manual authentication221–247; current versus Classic notice; Account settings/Domains

  2. How To Align Your Domain - MailerLite

    Sections Manual alignment232–248; sender/reply FAQ259 onward; historic-link warning282

  3. Troubleshooting: Domain authentication - MailerLite

    Sections DKIM troubleshooting; SPF merging222–240; string/lookup244 onward; verification token

  4. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Authentication status
MailerLite's account indication that its requested DNS records have passed checks.
Alignment subdomain
A dedicated MailerLite subdomain used by the optional alignment and branding setup.
Verification TXT
An account-issued DNS token used to establish control of the sending domain.
Historical-link dependency
A connection that previously sent campaign links still need to remain functional.
DMARC identifier
The visible From or authenticated SPF/DKIM domain used in the protocol's alignment comparison.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base