[ Sending-service guides ]

Authenticate email sent through Act-on: configuration and verification

Separate Act-On’s envelope-domain SPF from custom From-domain DKIM and validate the account-specific setup before campaign use.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Separate envelope SPF and MX from visible-From DKIM.
  • Use the correct account or parent-account selector.
  • Confirm current activation beyond the technical PDF.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Confirm current activation beyond the technical PDF.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Keep the envelope, From and account identifier fields separate and preserve the exact DNS diff.

Next steps

  1. Keep the envelope, From and account identifier fields separate and preserve the exact DNS diff.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Treat unresolved provider-document differences as a configuration hold, not proof of unsupported product capability.

Next steps

  1. Treat unresolved provider-document differences as a configuration hold, not proof of unsupported product capability.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Allow campaign launch only after the branded identity is demonstrated on a received test.

Next steps

  1. Allow campaign launch only after the branded identity is demonstrated on a received test.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Which domain needs envelope SPF?

The envelope domain selected for the Act-On route. Publishing at the visible From domain is not proof that the actual SPF identity is authorized.

Act-On: Email Deliverability Technical Requirements

Where does the DKIM CNAME belong?

Under each From domain being configured, using the account-specific host described by Act-On.

Act-On: Email Deliverability Technical Requirements

Can I use an account ID from an example?

No. Confirm your account or parent-account ID and current provider instructions.

Act-On: Email Deliverability Technical Requirements

Does the technical PDF finish onboarding?

It documents DNS requirements and points to further setup. Current activation must be confirmed for your account.

Act-On: Email Deliverability Technical Requirements

Should I replace the company MX records?

No. Scope any prescribed envelope MX record to the intended subdomain and preserve normal receiving mail.

Act-On: Email Deliverability Technical Requirements

Does a passing provider-domain SPF result pass DMARC?

Only if its authenticated domain aligns with the visible From under the applicable mode. Otherwise another aligned passing path is needed.

Is the private DKIM key sent to recipients?

No. Recipients use the public key to verify a signature. The private signing key must remain secret.

What if the PDF and account instructions differ?

Stop the conflicting change and get current account-specific guidance. Do not combine incompatible record sets.

Act-On: Email Deliverability Technical Requirements

[ Sources ]

Sources

  1. Act-On: Email Deliverability Technical Requirements

    Sections PDF page 1: envelope domain · PDF page 2: envelope SPF and MX · PDF page 3: DKIM per From domain; parent-account note

  2. RFC 9989: DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  3. RFC 7208: SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376: DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base