Momentus Elite can send venue correspondence without using your own mail server. Start by distinguishing its default sender, an individually confirmed sender address, and domain-authorized sending. These are not interchangeable proofs of SPF, DKIM or DMARC success. This guide explains the documented identity choices, how to prepare a controlled Elite message, and how to check the result. It is not a complete custom-domain DNS setup recipe: the public instructions do not supply your domain's issued records or a complete activation checklist.
Scope: Momentus Elite only. Do not apply these instructions to Momentus Enterprise, WeTrack, Momentus Connect or every legacy Ungerboeck installation.
Understand the three sender choices
Momentus documents a default From of no-reply@gomomentus.com, with replies directed to the email associated with the Elite account. A different Reply-To does not authenticate that address's domain as the visible sender.
For a branded From, the provider offers domain authorization using DKIM or individual sender confirmation. Domain authorization applies to users whose Elite login email uses the authorized domain. Check the login address, not just a preferred alias. Individual confirmation uses an email link for each address; that confirmation alone is not evidence of an aligned DKIM signature. Momentus also notes that Elite mail is not sent through your mail servers and does not appear in your mailbox's Sent folder. Official sender-identity instructions.
Do not confuse three meanings of “signature”: a personal signature in the email body is presentation; an individual sender confirmation establishes permission to use an address; DKIM is a cryptographic signature that the receiving service validates. Adding your job title or logo to a message does not configure DKIM.
Prepare the domain request without guessing DNS values
If you need branded sending, have the authorized administrator confirm the intended Elite account, login-domain spelling and message types before asking support for the applicable setup. Ask for the exact public DNS record types, complete owners and values, the intended signing domain, any required envelope-domain configuration, and the provider's verification and activation sequence. This is an implementation checklist to request, not a claim that every field is publicly documented or that every account supports every option.
The official contact route is Help in the application's left navigation, opening a messaging widget. This is asynchronous messaging, not live chat. Use the established support route rather than emailing DNS credentials. Momentus Elite support instructions.
Do not publish a guessed selector, copy another customer's DKIM value, supply a private key, or authorize a corporate Momentus domain merely because it appears in a DNS lookup. Keep existing selectors and policies intact. An issued record, a published record, a verified sender and an active signer are separate states. Stop before changes if the packet or activation responsibility is unclear.
Momentus's spam guidance identifies Postmark as its sending service. That is useful context, not permission to configure a separate Postmark account as though it controlled Elite. Tenant-issued settings must come from the supported Elite workflow. Official delivery explanation.
Produce a controlled message through Elite
After account administrators approve the test, use a valid recipient you control and harmless content. Avoid real contracts, invoices, personal client information or mass recipient groups. The purpose is to inspect the actual sending path, not to make a business commitment.
For an ad-hoc test, the official permissions are Email Activity Logs > Send for sending and Email Activity Logs > View for viewing logs. Open the Email tab on an event, account or contact, then Compose New Email. Choose the controlled To recipient before adding recipient-based merge fields. Set a recognizable subject and a short plain message. Review Send a copy to me, which is checked by default, and remove unintended recipients. Then send the approved test. The body's Include signature option does not enable DKIM. Official ad-hoc workflow.
Elite's documented limit is 50 recipients, including yourself when the copy option is selected. One controlled recipient is enough for an initial authentication check. If the production use case is document sending, subsequently test that specific route with an innocuous test document; an ad-hoc result does not prove all document paths behave identically. The email overview identifies document envelope icons and explains that logging must be enabled. Email in Momentus Elite.
Check the received message, not just the sender screen
Open the original/raw message at the controlled receiver. Record the actual visible From, Reply-To, envelope identity reported by the receiver, and DKIM d= signing domain and s= selector. Do not assume the envelope sender equals the login address or the From address.
Use Authentication-Results produced inside the receiving service's known processing boundary, following that service's documented handling of externally supplied Authentication-Results. Ignore attacker-supplied or untrusted result fields. A familiar authserv-id string or a header's position alone is not proof of origin. RFC 8601, trust boundary and security considerations.
For the default provider-domain route, record what actually passed and which domain it authenticated. It does not demonstrate authentication for your organization just because replies reach your inbox.
For a newly enabled branded DKIM route, require all of the following:
- The intended visible From remains your approved brand address, rather than a provider-domain rewrite.
- The intended provider signature returns
dkim=passand its signing domain aligns with that From under the applicable DMARC policy. - The trusted receiving result reports
dmarc=passfor that visible From.
A DMARC pass achieved through SPF alone is not a successful DKIM test. Other valid signatures may exist; identify the one belonging to the intended configuration. See EmailAuth's explanation of raw versus aligned DKIM results.
Relaxed DKIM alignment permits the same Organizational Domain; strict alignment requires an exact domain match. Under current RFC 9989, the Organizational Domain is the administrative boundary identified by the DMARC DNS Tree Walk, not automatically a public-suffix-list result or any matching final two labels. For example, a signature from mail.example.com can align with From example.com in relaxed mode, but not in strict mode. This is an illustrative relationship, not a Momentus-issued domain. Current DMARC standard, RFC 9989.
Diagnose SPF and delivery failures separately
SPF normally evaluates the SMTP MAIL FROM domain; for a null reverse path, the relevant HELO identity is used. It does not directly evaluate the visible From. Do not add an SPF include to your apex merely because Elite sent a message. First establish which domain and source were evaluated. This guide does not establish a universal Elite SPF include or custom Return-Path. RFC 7208, identities and evaluation.
| Observed result | What it means and what to do |
|---|---|
spf=fail |
The evaluated policy did not authorize the sending source. Give the actual evaluated domain, source and receiver result to the responsible sender administrator. For provider-owned domains, involve Momentus; do not edit your domain as a substitute. |
spf=temperror |
A temporary evaluation problem, often DNS-related. Retest after the temporary fault clears and ask the responsible DNS/provider team to investigate persistent errors. Do not broadly authorize extra senders as a workaround. |
spf=permerror |
The policy cannot be evaluated correctly, for example because of invalid syntax, multiple SPF policies or excessive DNS-dependent evaluation. Have the owner of the evaluated domain investigate the exact reason. |
| DKIM passes but DMARC fails | Compare the passing signature's domain with the actual From under current alignment rules; a valid unrelated signature is insufficient. |
| No message arrives | Inspect the bounce reason before treating the failure as DNS authentication. Recipient errors, policy, content and other delivery problems need different remedies. |
If an administrator eventually updates a customer-owned SPF policy, keep one v=spf1 TXT policy at that owner and preserve legitimate existing authorizations. SPF's limit is ten evaluated DNS-dependent terms, including nested lookups, not simply ten include strings. An all mechanism makes redirect ineffective. Qualifiers do not guarantee delivery or rejection by every receiver. RFC 7208, DNS limits.
With logging enabled, Elite records bounce details in the appropriate Account, Contact or Event Email tab, including recipient, timestamp and reason. Its optional bounce notifications concern messages you personally sent; notifications are not automatically evidence that all organizational mail succeeded. Track Email Bounces.
What counts as finished?
For this verification task, retain the intended route and sender, the approved test time, the actual trusted receiver results and any unresolved bounce or alignment issue. Store only necessary evidence with appropriate access controls. Do not share a full message containing customer data just to prove authentication.
For a future custom-domain deployment, retain the provider-issued packet and activation confirmation as well. Preserve existing direct and inherited DMARC protection; do not downgrade to monitoring mode to make a test appear successful. This guide does not prescribe a new DMARC policy, reporting destination, DNS delegation or mail-routing change.
Authentication is not an inbox-placement guarantee. The provider's delivery explanation distinguishes authentication from recipient filtering and reputation. Do not disable spam filtering, weaken transport security or broadly allowlist traffic merely because a test reaches Junk.
Common questions
Does Reply-To prove my domain is authenticated?
No. It directs replies. Verify the visible From, passing signature and DMARC alignment independently.
Can I use Postmark instructions to finish Elite setup myself?
Not unless Momentus confirms they apply to the actual Elite-controlled account and route. Shared backend technology does not give you its account permissions or issued DNS values.
Does this cover legacy Ungerboeck Enterprise?
No. The primary workflow here is Momentus Elite. Confirm the actual product before applying any account instructions.
Is the custom-domain setup already verified?
No. This is a documentary identity and testing guide. Customer-specific issuance, DNS publication, activation and delivered-message verification remain separate work; none was performed for this article.