[ Sending-service guides ]

Authenticate Customer Insights Journeys email in Dynamics 365

Use the Customer Insights – Journeys domain wizard for ownership, DKIM and envelope alignment, then verify the exact business unit and live journey route.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Use the exact Journeys environment and full issued DNS record set.
  • Check business-unit access and actual From fallback behavior.
  • Keep optional SPF compatibility changes separate from standard alignment.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Keep optional SPF compatibility changes separate from standard alignment.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the full wizard record set

Ownership, DKIM and envelope records each serve a separate purpose.

Next steps

  1. Copy every tenant-issued owner and target.
  2. Check business-unit domain availability.
  3. Match authoritative answers to a received journey message.

CISO / SecOps

Review scope before policy changes

Business-unit boundaries and domain-wide mail protection have different owners.

Next steps

  1. Review cross-organization domain availability.
  2. Treat extra SPF changes as explicit decisions.
  3. Keep DMARC intact while resolving route failures.

Founder / Non-technical

Confirm the customer journey identity

The intended brand must appear in the actual message, not only in settings.

Next steps

  1. Identify the sending product and environment.
  2. Approve the production From domain.
  3. Include reply and unsubscribe behavior in acceptance.

[ FAQs ]

Frequently asked questions

Does this configure every Dynamics 365 email?

No. It covers Customer Insights – Journeys. Identify the real mail route before applying it to CRM mailbox synchronization or another Dynamics application.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Which records does the domain wizard issue?

The documented process includes ownership TXT, two DKIM CNAMEs and an Envelope-From CNAME. Use the current environment’s exact values.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Can I use the default authenticated domain for my branded rollout?

It is intended for initial testing or demonstration. Authenticate the actual domain that should appear in the organization’s production From address.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Why can a verified domain be unavailable to another business unit?

Modernized business-unit scoping can limit domain availability. Review ownership and organization-wide availability in the current environment.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Do I need to add a Dynamics include to the root SPF record?

The wizard supplies the standards-based setup. Microsoft describes an additional compatibility option for some receivers; assess that separately using the environment-specific value.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Does form-domain approval prove email authentication?

No. Form hosting permissions and email DNS authentication are separate configurations.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What if the DNS records look right but the message uses another domain?

Inspect the journey asset’s actual From address, business-unit access and selected environment. Verify the delivered identities instead of relying on the domain list.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What keeps this candidate on hold?

Product-scope confirmation, actual tenant values, authoritative DNS evidence, a received journey message and human SME approval remain open.

Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn https://www.rfc-editor.org/rfc/rfc7208.html https://www.rfc-editor.org/rfc/rfc6376.html RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

[ Sources ]

Sources

  1. Authenticate your domains - Dynamics 365 Customer Insights | Microsoft Learn

    Sections Default domain42–54; wizard61–102; SPF compatibility103–105; modernized business units

  2. Fix Domain Authentication in Customer Insights - Journeys - Dynamics 365 Customer Insights | Microsoft Learn

    Sections Required records45–80; Confirmed82–86

  3. Best practices for email marketing - Dynamics 365 Customer Insights | Microsoft Learn

    Sections Build/protect sender reputation; permission and unsubscribe guidance

  4. https://www.rfc-editor.org/rfc/rfc7208.html

    Sections §3.2; 3.3; 4.6.4

  5. https://www.rfc-editor.org/rfc/rfc6376.html

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Customer Insights – Journeys
The Dynamics 365 application and sending workflow covered by this candidate.
Envelope-From
The SMTP reverse-path identity used for delivery failures and evaluated by SPF.
Business-unit scoping
Controls that affect which organizational units can access the authenticated domain.
Ownership verification
A DNS check establishing control of the domain before sending configuration is accepted.
Fallback identity
A service-provided sender identity used instead of the intended custom domain in a particular message.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base