[ Sending-service guides ]

Mesh outbound authentication with upstream or optional gateway signing

Confirm the Mesh product, region and deployed DKIM capability before routing outbound mail; preserve upstream signing or validate a supported Mesh key on received messages.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Confirm Gateway or Unified product scope and the deployed region before enabling outbound smarthost.
  • Choose upstream DKIM or the documented optional gateway signer deliberately.
  • Validate DNS and a received message through the entire relay chain, including content-changing services.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Validate DNS and a received message through the entire relay chain, including content-changing services.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Resolve tenant capability before selecting a signer

Both current setup guides document optional Mesh signing alongside preservation of upstream signatures.

Next steps

  1. Confirm product, region and DKIM UI.
  2. Test upstream and downstream processing on the final received message.
  3. Compare region-specific authorization with the actual tenant.

CISO / SecOps

Keep relay exceptions narrow

Authentication and filtering coverage are distinct acceptance goals.

Next steps

  1. Review any bypass separately.
  2. Require evidence of the exact route and aligned signing path.
  3. Retain tenant-specific signing and activation evidence before accepting the deployed configuration.

Founder / Non-technical

Budget for a controlled routing change

An outbound gateway affects staff and application mail, not just a DNS label.

Next steps

  1. Name rollback authority.
  2. Do not approve cutover from documentation alone.
  3. Make recovery timing part of the cutover decision.

[ FAQs ]

Frequently asked questions

Does every Mesh product include outbound smarthost?

The cited Mesh guide limits the workflow to Gateway and Unified. Confirm the customer’s actual product.

Outbound Smarthost | Mesh

Can Mesh generate a DKIM key?

Yes. Both the Mesh help center and the Bitdefender-hosted guide document optional key generation, with 2048/4096-bit keys, a selector, a public TXT record and Check Validation. Confirm the selected path in the deployed tenant.

Outbound Smarthost | Mesh Outbound Smarthost

Must I replace upstream DKIM?

No. The documented upstream-signing path can remain valid. Test whether signatures survive the complete route.

Outbound Smarthost | Mesh RFC 6376 DKIM

Which SPF include should I use?

Use the current instructions for the actual region. EU/US and DTS/OVH guidance differs across the cited pages.

Outbound Smarthost | Mesh Outbound Smarthost Connection Details | Mesh

What does Check Validation prove?

It checks the configured DNS key in the documented workflow. A received message is still needed to prove that the route uses the expected signer.

Outbound Smarthost | Mesh RFC 6376 DKIM

Does enabling outbound status take effect instantly?

The Mesh guide advises allowing up to 15 minutes. Confirm tenant status before sending rather than relying solely on elapsed time.

Outbound Smarthost | Mesh

Should a branding relay be ignored during DKIM testing?

No. Any downstream content modification can matter, so test the complete configured chain.

RFC 6376 DKIM

What remains on hold?

Deployed feature and region confirmation, tenant-specific key selection and activation, live DNS and received-message tests, and human SME approval.

[ Sources ]

Sources

  1. Outbound Smarthost | Mesh

    Sections Outbound Setup · DKIM Keys

  2. Release Notes 1.7.11 | Mesh

    Sections New Features

  3. Outbound Smarthost

    Sections Outbound Smarthost · Service region · DKIM keys

  4. Connection Details | Mesh

    Sections SPF Record

  5. RFC 7208 SPF

    Sections §3.2 · §3.3 · §4.6.4

  6. RFC 6376 DKIM

    Sections §3.5 · §3.6.2 · §6.1

  7. RFC 9989 DMARC

    Sections §4.4 · §4.7 · §4.10 · §5

[ Glossary ]

Glossary

Smarthost
A relay through which an upstream mail system routes outbound messages.
Upstream signer
A system that applies DKIM before a message reaches the gateway.
Outbound connector
A mail-flow configuration selecting a delivery route and scope.
Selector
The DKIM label identifying the public verification record for a signature.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base