CSI SPF, DKIM and DMARC setup, step by step

If you send email through CSI, receiving servers decide whether to trust those messages by checking SPF, DKIM and DMARC for your domain. Under DMARC (RFC 9989), at least one of SPF or DKIM must pass and align with the domain in your From address, which usually means authorising CSI in your SPF record and publishing the DKIM key it gives you, so you can move your DMARC policy towards quarantine or reject without breaking those emails.

The exact include, selector and key values depend on your CSI account, so we don't guess them here. The EmailAuth AI Agent reads your domain's live DNS, tells you what's missing for CSI, and gives you ready-to-paste records, or walks you through each step. Start with your domain below, or book a free call with an EmailAuth engineer.

To get specific help for CSI, engage with our EmailAuth AI Agent. It reads your domain's live DNS, checks what is already in place, and gives you ready-to-paste records or walks you through each step.

Open the EmailAuth AI Agent

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Email sender SPF, DKIM & DMARC setup guides