[ Sending-service guides ]

Authenticate email sent through Kallidus: configuration and verification

Configure Kallidus system-mail authentication while keeping its separate calendar-invitation route and live verification gaps visible.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Protect required notifications
  • Validate system mail separately
  • Control the sender trust change
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Configure Kallidus system-mail authentication while keeping its separate calendar-invitation route and live verification gaps visible.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Validate system mail separately

Mail admin: Application notifications and integrated calendar mail may use different senders.

Next steps

  1. Confirm the product and domain.
  2. Check both selector owners and the whole SPF policy.
  3. Capture separate receiver evidence for each route.

CISO / SecOps

Control the sender trust change

CISO: DNS authorization does not replace route-specific evidence or data handling controls.

Next steps

  1. Review the scope of vendor trust.
  2. Protect employee information in test messages.
  3. Approve closure only after alignment is demonstrated.

Founder / Non-technical

Protect required notifications

Founder: Authentication changes must not interrupt learning communications.

Next steps

  1. Name the business owner.
  2. Schedule changes away from critical deadlines.
  3. Keep an approved recovery route.

[ FAQs ]

Frequently asked questions

Why are two Kallidus DKIM records documented?

They support rotation and replacement. Publish both approved selector records, not just the one observed on a sample message.

System requirements 6 March 2026

Is publishing DNS enough to close the change?

No. Confirm any tenant-side activation and inspect actual received messages.

System requirements 6 March 2026

Can I treat a calendar invitation as the system-mail test?

No. Keep integrated-mailbox invitations separate from the application notification route.

System requirements 6 March 2026

Does the documented a mechanism remove every SPF lookup concern?

No. An a mechanism also consumes a DNS lookup. Evaluate the entire policy before using an alternative.

System requirements 6 March 2026 RFC 7208 SPF

Should I replace my existing SPF record with a vendor-only policy?

No. Preserve legitimate senders and maintain one policy at the applicable DNS owner.

RFC 7208 SPF

Will allowlisting prove that DMARC passes?

No. Filtering exceptions and authenticated domain alignment are separate matters.

Does this guide cover every Kallidus-branded product?

No. Confirm that the exact product and tenant use the documented system-mail route.

System requirements 6 March 2026

What evidence is still required?

Live tenant activation, authoritative DNS checks, real notification and invitation results, and an SME’s product-scope review remain outstanding.

[ Sources ]

Sources

  1. System requirements 6 March 2026

    Sections Office 365 and Microsoft Exchange · Email signing and junk mail prevention: DKIM and SPF · How do I implement DKIM? · How do I implement SPF?

  2. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  3. RFC 6376 DKIM

    Sections §3.5 · §6

  4. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

System-originated email
Mail generated by the application’s notification workflow.
DKIM selector
The identifier used to find the public key for a message’s signature.
CNAME
A DNS alias pointing a name to another DNS name.
SPF lookup limit
The protocol limit on DNS-querying terms evaluated while checking a policy, including nested terms.
Receiver evidence
The delivered message and authentication results supplied by the receiving system being trusted.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base