[ Sending-service guides ]

Mautic authentication through the configured sending transport

Authenticate the service or mail server selected in Mautic, then test the real campaign and its From overrides so the passing identity aligns with the intended domain.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Configure authentication at the actual transport or signing MTA.
  • Resolve tokenized and contact-owner sender choices before DNS work.
  • Compare quick tests with real queued campaigns without duplicate replay.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Compare quick tests with real queued campaigns without duplicate replay.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify defaults and overrides

The configured service and actual message identities determine the records.

Next steps

  1. Use version-matched settings.
  2. Test campaign delivery through the real worker, not only the preview send.
  3. Compare From overrides when only one campaign fails.

CISO / SecOps

Audit the whole signing chain

A downstream signature may authenticate the provider rather than the organization.

Next steps

  1. Review the completed route worksheet and its unresolved rows.
  2. Require aligned authentication for each approved From domain.
  3. Review downstream content changes before accepting a signing design.

Founder / Non-technical

Keep campaigns tied to a known transport

Changing an integration can affect every queued communication.

Next steps

  1. Record which business workflows depend on it.
  2. Approve a pause and rollback window before changing senders.
  3. Plan how to pause queued campaigns without duplicate replay.

[ FAQs ]

Frequently asked questions

Is there a universal Mautic SPF include?

No. Authorize the actual sending service or mail server at the envelope identity required by that route.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Where is DKIM configured?

Usually at the sending service selected in Email Settings, or at the organization’s own signing mail server. Confirm the deployed version and transport.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I use a selector from an old Mautic tutorial?

Do not assume it applies. The current signer must issue or configure the matching key and selector.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why does a quick test pass while a campaign fails?

They may differ in From overrides, transport execution or queued worker configuration. Compare the actual received identities and application settings.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does Reply-To control SPF alignment?

No. SPF normally evaluates MAIL FROM; Reply-To directs responses.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What if DKIM passes for the provider domain?

That pass does not supply DMARC alignment for an unrelated customer From domain. Complete customer-domain signing or another aligned path.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I add the Mautic web server IP to SPF?

Only if it is actually part of the authorized outbound SMTP route. A web host that submits to a provider is not automatically the receiver-facing sender.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What remains before acceptance?

Verify the installed version, transport, issued records and controlled live campaign messages, then obtain human SME approval.

How to set up SPF for Mautic - Mautic Knowledgebase How to set up DKIM for Mautic - Mautic Knowledgebase Mautic configuration settings — Mautic Documentation 0.1 documentation RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. How to set up SPF for Mautic - Mautic Knowledgebase

    Sections Steps1–5 and common problems58–102; provider route and observed envelope

  2. How to set up DKIM for Mautic - Mautic Knowledgebase

    Sections Steps1–4,59–89; configure responsible service and selector

  3. Mautic configuration settings — Mautic Documentation 0.1 documentation

    Sections Transport warning176–178; queue184–195; mail send198–212; return path205; sender precedence211

  4. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Transport
The configured service or mail-server connection used to submit Mautic messages.
Queue worker
A process that handles queued application work, including relevant sending jobs.
From override
An email-specific or workflow-specific sender choice that can differ from the configured default.
DKIM signing domain
The d= domain authenticated by a valid DKIM signature.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base