[ Sending-service guides ]

Authenticate MessageGears email with a delegated sending subdomain

Use MessageGears support to establish the correct authentication-domain assignment, then verify DNS delegation and the actual campaign or API message.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Use a previously unused child subdomain for the support-managed delegation workflow.
  • Check Default assignments and Dynamic From-domain mappings for each sending account.
  • Verify delegation and actual aligned mail separately from branded tracking and Sender headers.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify delegation and actual aligned mail separately from branded tracking and Sender headers.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the delegation and mapping

Publishing NS values and activating the correct account are separate steps.

Next steps

  1. Obtain the support-issued values and assignment.
  2. Capture authoritative DNS before and after.
  3. Test Default and Dynamic cases independently.

CISO / SecOps

Review the delegated namespace

The provider gains authority over the chosen child namespace.

Next steps

  1. Check existing uses before delegation.
  2. Retain the domain-wide DMARC policy during diagnosis.
  3. Require aligned live-message evidence before closure.

Founder / Non-technical

Approve the branded sending route

The business should know which accounts and messages will use the new identity.

Next steps

  1. Name the workflows and From domains in scope.
  2. Assign one campaign owner for acceptance.
  3. Approve a limited rollout and recovery plan.

[ FAQs ]

Frequently asked questions

Does MessageGears require me to publish a DKIM key manually?

Its current custom-authentication guide recommends subdomain delegation managed with support. Confirm whether your account still uses an older arrangement before changing it.

Custom authentication & secure click tracking links | MessageGears Docs

Which details should the support request contain?

Include the Customer Org, unused child subdomain and the account IDs for a Default assignment or From domain for a Dynamic mapping. Keep the returned nameservers in the change record.

Custom authentication & secure click tracking links | MessageGears Docs

Can one verified domain prove every account is configured?

No. Verify the Default assignment and any Dynamic overrides for each account and From-domain combination actually used.

Custom authentication & secure click tracking links | MessageGears Docs

Should I copy the sample SPF policy onto my root domain?

Not without confirming the evaluated envelope domain and support instructions. Preserve other senders and merge any required authorization into the single existing policy.

Email Authentication and DMARC | MessageGears Docs https://www.rfc-editor.org/rfc/rfc7208.html

Does a branded tracking link prove DMARC alignment?

No. Link behavior and the message authentication identities are separate tests.

Custom authentication & secure click tracking links | MessageGears Docs RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Can OnBehalfOf repair an unaligned From domain?

Do not rely on it. It populates the Sender header; DMARC evaluates alignment with the visible From domain through SPF or DKIM.

OnBehalfOf | MessageGears Docs RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What proves the delegation works?

Retain public delegation answers, direct authoritative queries, support activation confirmation and a received message showing the intended authentication identities.

Custom authentication & secure click tracking links | MessageGears Docs Email Authentication and DMARC | MessageGears Docs

Is this setup ready for publication as a tested customer example?

No. The tenant assignment, live DNS evidence, controlled-message identity record and human SME approval remain outstanding.

[ Sources ]

Sources

  1. Custom authentication & secure click tracking links | MessageGears Docs

    Sections Custom authentication domains · Default vs. dynamic signing domains · Subdomain delegation · Why delegation? · Secure click tracking

  2. Email Authentication and DMARC | MessageGears Docs

    Sections SPF · Sample SPF record for sending with MessageGears · DKIM · DMARC

  3. OnBehalfOf | MessageGears Docs

    Sections OnBehalfOf

  4. https://www.rfc-editor.org/rfc/rfc7208.html

    Sections §3.2 · §3.3 · §4.6.4

  5. https://www.rfc-editor.org/rfc/rfc6376.html

    Sections §3.5 · §3.6.2 · §6.1

  6. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections §4.4 · §4.7 · §4.10 · §5

[ Glossary ]

Glossary

Default authentication domain
The MessageGears authentication domain assigned to a sending account.
Dynamic authentication domain
An organization-level mapping selected when the message From domain matches its configuration.
Subdomain delegation
An NS delegation that makes a different nameserver set authoritative for a child namespace.
Return-Path
A received-message representation of the SMTP reverse-path used for delivery errors.
Alignment
The required relationship between a passing authentication domain and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base