[ Sending-service guides ]

Authenticate email sent through Braze: configuration and verification

Match Braze authentication to the provisioned email architecture, keep return-path and From identities distinct, and validate workspace access before sending.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Match provisioning to the actual ESP architecture.
  • Keep sending, bounce and tracking identities distinct.
  • Verify workspace access and both domain readiness states.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify workspace access and both domain readiness states.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Reconcile the exact ESP architecture, DNS record set and workspace permissions.

Next steps

  1. Match records to the provisioned ESP architecture.
  2. Test sender identity and tracking only when both domains are ready.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Limit domain access and review delegation scope rather than treating all workspaces as equivalent.

Next steps

  1. Grant the minimum workspace scope.
  2. Coordinate support-led domain removal with active campaign dependencies.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Choose the domain hierarchy before onboarding because submitted identities are not casual edits.

Next steps

  1. Approve the domain hierarchy before submission.
  2. Plan workspace access with campaign owners.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Can every existing customer use the cited self-service flow?

The documentation scopes it to new-customer onboarding with the listed permissions and infrastructure. Confirm your route.

Braze email self-serve

Are Sending domain and Mail from the same field?

No. One controls the visible From identity; the other is the envelope identity used for bounces and SPF.

Braze email self-serve

Should I add Braze SPF at the corporate root?

Use the provisioned return-path architecture. Braze’s DNS guide places that authorization on a dedicated subdomain.

Braze DNS architectures

Can I copy another account’s CNAME targets?

No. Use records mapped to your own architecture and environment.

Braze DNS architectures

Will sibling subdomains satisfy strict SPF alignment?

No. Strict alignment requires the SPF-authenticated domain to equal the visible From domain exactly.

RFC 9989 DMARC

Why is tracking still pending when sending is ready?

They are separate domain configurations and can validate at different times.

Braze email self-serve

Can I edit a submitted sending domain?

The self-service documentation says it cannot be changed after submission; coordinate deletion with support.

Braze email self-serve

What proves a workspace is ready?

The intended domain is available to that workspace and a controlled message shows the correct sender, alignment and working links.

[ Sources ]

Sources

  1. Braze email self-serve

    Sections Prerequisites · Considerations · Steps 1–3 · Step 5: Test your email sending · Frequently asked questions: four NS record lines

  2. Braze DNS architectures

    Sections Core email authentication fundamentals · ESP-specific DNS architecture: SparkPost, SendGrid, Amazon SES

  3. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  5. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  6. RFC 1034 DNS concepts

    Sections §3.6.2 Aliases and canonical names · §4.2 How the database is divided into zones

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base