[ Sending-service guides ]

Authenticate email sent through Expoints: configuration and verification

Choose Expoints delivery or your own SMTP relay, coordinate the survey domain and reply handling, and verify the resulting authentication identities.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Choose Expoints delivery or customer SMTP first.
  • Survey HTTPS, mail authentication and reply forwarding are separate checks.
  • Do not promise bounce statistics on the customer SMTP route.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Do not promise bounce statistics on the customer SMTP route.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Record which transport signs

The relay choice determines where authentication must be fixed.

Next steps

  1. Document the selected SMTP route.
  2. Obtain exact DKIM instructions.
  3. Retain receiver headers and prior DNS values.

CISO / SecOps

Control domain and reply trust

The integration grants sending authority and can forward customer replies.

Next steps

  1. Review the selector and SPF scope.
  2. Approve reply forwarding recipients.
  3. Retire unused trust only after dependency checks.

Founder / Non-technical

Own the complete survey journey

A successful invitation still fails its purpose if the survey or replies break.

Next steps

  1. Approve the sender and survey names.
  2. Assign a reply owner.
  3. Require a controlled end-to-end test.

[ FAQs ]

Frequently asked questions

Should the survey domain and sender domain match?

Expoints recommends this for a coherent customer experience. It is not itself a DMARC pass condition; authentication alignment still needs a received-message check.

Expoints: Using client domain

What distinguishes the two sending routes?

Expoints can send directly, or it can hand mail to your SMTP server. The latter changes transport ownership and limits Expoints bounce statistics.

Expoints: Using client domain

Where do I obtain the DKIM key?

From the Expoints implementation team after agreeing the selector and domain. Do not invent a key or borrow another account’s record.

Expoints: Using client domain

Is the survey CNAME a DKIM record?

No. It serves the survey website. Authentication records must be configured separately for the chosen sending route.

Expoints: Using client domain

Can I add a second SPF record for Expoints?

No. Review and update the single existing SPF policy at the relevant owner, preserving legitimate senders and checking DNS-lookup limits.

Who handles survey replies?

The documented customer-domain flow forwards replies from the chosen inbox to Expoints. Approve and test that route separately.

Expoints: Using client domain

Does SMTP acceptance prove delivery?

No. It proves the relay accepted a handoff, not that the recipient accepted or authenticated the final message.

What evidence closes the setup?

A real invitation’s trusted receiver results, successful survey navigation, confirmed reply handling and named operational ownership. None is claimed as executed here.

[ Sources ]

Sources

  1. Expoints: Using client domain

    Sections Using your own domain to send mails and host survey · Two mailing alternatives · Reply address forwarding and certificate contacts

  2. RFC 9989: DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  3. RFC 7208: SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376: DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Alignment
The relationship between the visible From domain and a successfully authenticated SPF or DKIM identity under the applicable DMARC mode.
Selector
The DKIM label identifying which public-key record the verifier queries.
Envelope sender
The SMTP identity used for delivery errors and normally evaluated by SPF; it is distinct from the visible From field.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base