[ Sending-service guides ]
Authenticate email sent through FireDrum: configuration and verification
Use FireDrum’s ordered DKIM, DMARC and SPF validation without overwriting existing policy, then verify a real campaign’s alignment.
By the EmailAuth research team · 4 min read
[ Key points ]
- Finish DKIM authentication before expecting remaining records.
- The ordered test stops at its first failure.
- Preserve existing SPF and DMARC decisions.
[ Takeaway ]
Preserve existing SPF and DMARC decisions.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Follow the validation sequence
Later tests are hidden behind earlier failures.
Next steps
- Resolve DKIM first.
- Preserve one SPF and one DMARC policy.
- Capture aligned receiver results.
CISO / SecOps
Avoid accidental policy weakening
Adding a campaign sender should not erase domain-wide safeguards.
Next steps
- Review existing enforcement.
- Approve the signing delegation.
- Track removal of obsolete sender permissions.
Founder / Non-technical
Make campaign acceptance explicit
A blocked editor and a delivered campaign are different milestones.
Next steps
- Assign a campaign test owner.
- Approve a limited test audience.
- Require evidence before a broad send.
[ FAQs ]
Frequently asked questions
Why can I not pass the Content step?
FireDrum requires the From domain to pass its authentication checks. Use a controlled custom domain and complete the documented setup.
Where do I start?
Account > Settings > Authenticated Domains > Add Domain. The first stage displays the DKIM CNAME.
Why are SPF instructions not visible yet?
The documented workflow reveals the remaining records after DKIM authentication. Resolve that first stage instead of guessing values.
Does an absent SPF test mean SPF is fine?
No. The test stops at the first failure in the order DKIM, DMARC, SPF.
Should I add another DMARC record?
No. FireDrum says an existing DMARC record does not need replacement merely to use the application.
How do I add FireDrum to existing SPF?
Review the single policy and incorporate the required include while preserving legitimate senders and checking lookup limits.
Will a green DNS check guarantee inbox placement?
No. Verify an actual campaign’s aligned authentication, then investigate placement separately if needed.
What should I retain for sign-off?
The approved DNS values, account test results, original received message, alignment analysis and a named rollback owner.
[ Sources ]
Sources
- FireDrum: Custom Domain Authentication
Sections Before you begin · Verify your domain · Custom Domain Authentication – DKIM · Setting up DMARC; Creating an SPF TXT record · Test DNS Records
- RFC 9989: DMARC
Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail
- RFC 7208: SPF
Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits
- RFC 6376: DKIM
Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions
[ Glossary ]
Glossary
- Alignment
- The relationship between the visible From domain and a successfully authenticated SPF or DKIM identity under the applicable DMARC mode.
- Selector
- The DKIM label identifying which public-key record the verifier queries.
- Envelope sender
- The SMTP identity used for delivery errors and normally evaluated by SPF; it is distinct from the visible From field.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption