[ Sending-service guides ]

Authenticate Ortto custom email domains without confusing tracking status with sender status

Use Ortto-issued records for the current account, separate email and tracking verification, and test the actual From domain after migration or fallback.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Verify sender and tracking status independently.
  • Use account-issued CNAMEs and check exact subdomain names.
  • Treat Autopilot migration and provider-domain fallback as explicit decisions.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Treat Autopilot migration and provider-domain fallback as explicit decisions.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Test the account-issued record set

Current Ortto records must match the authoritative zone for the actual account.

Next steps

  1. Export existing DNS before edits.
  2. Verify every generated CNAME and domain status.
  3. Retain receiver headers from the real workflow.

CISO / SecOps

Approve alignment evidence

Authentication claims require receiver results and scope control.

Next steps

  1. Review From and authenticated-domain alignment.
  2. Keep tracking and email acceptance separate.
  3. Require sign-off before enforcement changes.

Founder / Non-technical

Protect campaign identity

A working tracking link does not establish the visible sender identity.

Next steps

  1. Approve the intended sending domain.
  2. Schedule migration tests before a campaign.
  3. Decide whether temporary provider-domain fallback is acceptable.

[ FAQs ]

Frequently asked questions

Does a verified tracking domain authenticate my From address?

No. Track the sending-domain status separately and inspect a received campaign message.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

How many CNAME records should I expect?

Ortto documents three for email only and four for email plus tracking. Use the exact records generated for your selected features and account.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Can I reuse an Autopilot verified domain unchanged?

Do not assume so. Ortto documents separate verification after account unification and may require regenerated CNAME records.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Is an SPF edit mandatory for Ortto custom domains?

Ortto describes it as recommended rather than mandatory. Any edit must preserve the existing legitimate sender policy and target the correct identity.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Why did the From domain change?

An unverified or unavailable custom domain can trigger fallback. Check the account status and received message before changing DNS.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Should CNAME records be proxied?

Ortto instructs Cloudflare users to select DNS only for the relevant CNAME records.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

Can two Ortto accounts share a domain?

The provider says yes, using account-specific authentication records. Verify the records for each account separately.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

What proves completion?

Matching public DNS, successful provider verification, a controlled received message with aligned authentication, and owner review. No live evidence was collected for this draft.

Ortto custom domains Ortto custom domain troubleshooting SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989

[ Sources ]

Sources

  1. Ortto custom domains

    Sections Record count94–101; DNS-only114; optional SPF199–219; statuses272–282

  2. Ortto custom domain troubleshooting

    Sections Pending9–36; migration73–78; duplicate owner81–84

  3. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  4. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  5. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

SPF
A mechanism for evaluating whether a connecting sender is authorized for an SMTP identity.
DKIM
A cryptographic message signature associated with a signing domain and selector.
DMARC alignment
The relationship required between an authenticated SPF or DKIM domain and the visible From domain.
Tracking subdomain
A domain used for tracking links or activity, separate from the email authentication identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base