[ Sending-service guides ]

Authenticate email sent through Apptoto: configuration and verification

Apptoto can send through its own service or a connected mailbox. Match the selected address and calendar route before applying its three-CNAME DKIM setup or SPF authorization.

By the EmailAuth research team · 6 min read

[ Key points ]

  • An exact connected-mailbox match selects a different route from hosted mail.
  • Verify all three generated DKIM CNAMEs for hosted custom-domain sending.
  • Test calendar overrides and fallback sender identity, not only the default.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test calendar overrides and fallback sender identity, not only the default.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Own records and route evidence

Documentary setup is not a substitute for an aligned received-message result.

Next steps

  1. Retain the provider record set and before-change DNS export.
  2. Complete provider activation and verify every intended route.
  3. Record the raw message, trusted results and rollback owner.

CISO / SecOps

Approve scoped trust and residual risk

Provider signing authority and domain policy affect more than one campaign.

Next steps

  1. Review selector ownership and shared-service dependencies.
  2. Keep domain-wide enforcement separate from this integration change.
  3. Require human review and live evidence before publication or production sign-off.

Founder / Non-technical

Protect the Apptoto business workflow

Sender changes can disrupt customer recognition and replies even when authentication passes.

Next steps

  1. Identify the exact messages customers need.
  2. Approve the intended From and fallback identities.
  3. Release only after operations reviews a controlled message.

[ FAQs ]

Frequently asked questions

Do connected Microsoft or Gmail mailboxes need Apptoto DNS records?

The documented connected-mailbox route needs no additional Apptoto DNS setup for that address. The mailbox provider remains responsible for its own sending authentication.

Apptoto outgoing email

How many DKIM records does Apptoto generate?

Its deliverability guide specifies three CNAMEs and requires all three Verified entries to show true. Use your account-generated values.

Apptoto ensuring email deliverability

Which SPF mechanism does Apptoto document?

For mail Apptoto sends on your behalf, it documents a:mailers.apptoto.com before the final all mechanism. Merge it with legitimate existing senders rather than replacing their policy.

Apptoto ensuring email deliverability

Why did one calendar send through a different route?

Calendar-Specific Sending can select its Email or Admin Email. Only an exact matching connected-mailbox address uses that mailbox; unmatched custom addresses may use Apptoto-hosted sending.

Apptoto outgoing email

What happens when a connected mailbox stops working?

Apptoto documents a fallback to reminders@apptoto.com until reconnection. Verify this changed sender is acceptable; it is not evidence that your custom domain authenticated.

Apptoto outgoing email

What does Needs DKIM setup mean?

The custom-domain address has not completed verification in Email Domain Settings. Add its generated CNAMEs and use Verify DNS Settings.

Apptoto ensuring email deliverability

Should I use the fixed-IP SPF alternative?

Apptoto documents one but warns it may change. Prefer its maintained hostname where possible; resolve lookup-budget issues without treating a stale fixed address as permanent.

Apptoto ensuring email deliverability

Why is open tracking missing on a working reminder?

The Outgoing Email documentation says messages sent through connected mailboxes do not report opens. Check route and authentication independently from tracking.

Apptoto outgoing email

[ Sources ]

Sources

  1. Apptoto ensuring email deliverability

    Sections Check your sending address · Adding or Updating Your SPF Records · Set up DKIM on your domain in Apptoto · DNS Verification Needed for DKIM in Apptoto

  2. Apptoto outgoing email

    Sections Sending Addresses · Connect a Gmail or Microsoft mailbox · What the statuses mean · Calendar-Specific Sending · Tracking

  3. RFC 7208

    Sections §3.2 Multiple DNS records · §4.6.4 DNS lookup limits · §5.2 include · §5.3 a

  4. RFC 6376

    Sections §3.5 DKIM-Signature · §3.6.2.2 TXT record concatenation · §6 Verifier actions

  5. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail · §5.3.6 Apply policy if appropriate

[ Glossary ]

Glossary

Envelope identity
The SMTP sender identity evaluated by SPF, distinct from the visible From address.
DKIM selector
The s= identifier used with the signing d= domain to locate a public verification key.
Alignment
The domain relationship required between an authenticated identity and the visible From domain for DMARC.
CNAME
A DNS alias record; publish only the provider-supplied name and target for the intended service.
TXT record
A DNS resource record used for SPF, DKIM public keys and DMARC policies; multiple strings can form one value.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base