[ Sending-service guides ]

Authenticate email sent through Acoustic: configuration and verification

Provision Acoustic Campaign domains through the documented support process, distinguish hosted DNS from supplied records, and validate the selected sending identity.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Choose From-only versus fully branded custom-domain scope first.
  • Follow the provisioning specialist and exact delegated DNS boundary.
  • Verify message identities and branded links as separate outcomes.
On this page

Provider documentation checked on 8 November 2026. Account-generated values, entitlements and current support remain deployment prerequisites.

Acoustic Campaign distinguishes a custom domain from an additional From domain. A custom domain can include branded links and related sending infrastructure; a From-only configuration does not carry all of that branding. Choose the intended architecture before asking a DNS administrator to publish records. This guide covers Campaign provisioning, not every product carrying the Acoustic name.

Start with the provisioning case

The From-domain guide requires a custom domain to exist first and a support case for the additional From domain. It also warns against performing its provisioning changes until the account representative or client success director has placed the order and a specialist directs the work. Follow that boundary rather than treating published examples as a self-service recipe.

Prepare the Campaign organization name, pod, proposed domain and the intended reply-handling arrangement. Acoustic accepts only subdomains for custom email domains. Neither the custom email domain nor a From domain may reuse the domain assigned to a custom landing page. Record whether this is a new custom domain or an additional sender identity. Identify the existing DNS owner and preserve the current zone before any delegation is considered.

Choose the DNS responsibility model

References: RFC 1034 §4.2.

According to the custom-domain provisioning guide, Acoustic supplies the appropriate DNS instructions. In an Acoustic-hosted arrangement, the customer implements supplied nameserver records and Acoustic manages the relevant SPF, MX, bounce, reply and DKIM records. In an externally hosted arrangement, the customer publishes the supplied record set. The From-domain guide specifically says multi-client shared IP pools require Acoustic-hosted DNS.

Confirm the exact subdomain being delegated. Changing a parent domain's nameservers can affect websites and corporate email, not just campaigns. Do not delegate a name already carrying unrelated services without a complete migration plan. Keep the provisioning case's ownership decision and record list as the source of truth; no universal Acoustic SPF policy is supplied here. Acoustic warns that a configured custom domain cannot be repurposed or updated. Settle its intended use before provisioning; coordinate a replacement with the specialist rather than planning an in-place identity change.

Implement only the approved record set

References: RFC 7208 §3.2, RFC 1034 §3.6.2.

For external DNS, map each supplied full owner and type into the host's editor, preserving its actual value. Maintain one SPF policy at the relevant envelope owner and preserve legitimate dependencies. A DKIM CNAME must not collide with existing ordinary data at its owner. For hosted DNS, verify delegation and ask the provisioning team to confirm its records after the nameserver change rather than adding duplicate data to an inactive parent-zone editor.

Custom-domain setup also includes a later CNAME step for SSL certificates after initial validation, as described by Acoustic. Keep link certificates and authentication as separate checks: a working HTTPS link does not prove DKIM alignment, and a passing DKIM signature does not prove branded links are ready.

Verify the active selector rather than guessing

References: RFC 6376 §3.6.2, RFC 2308 §5.

Acoustic's deliverability guidance documents spop1024 and spop2048 selector conventions and says the provisioning team determines the selector. Inspect the actual DNS and message signature to learn which is active. Both may be present during a transition; their presence alone is not a reason to delete either.

Query the exact selector owner at the authoritative server, and verify SPF at the actual envelope domain. Capture the delegation, answers, TTLs and provisioning confirmation. A correct record in a non-authoritative editor is not publication. Different recursive answers can reflect caches, including cached absence; persistent authoritative disagreement needs investigation rather than a longer wait.

Send a controlled Campaign message

References: RFC 9989 §4.4.

Use the provisioned From domain and intended VMTA or sending configuration in a harmless test to an approved mailbox. Retain the visible From, Return-Path, DKIM d=/s= values and trusted receiver results. Confirm a passing aligned path under the effective DMARC mode. Check reply handling, bounce behavior and branded links against the agreed configuration, without sending a production campaign merely to test setup.

Illustrative outcome: the new From domain authenticates but links still use the existing custom domain. That can match a From-only design; it is not automatically a DKIM defect. If the business expected newly branded links, revisit the requested architecture instead of changing authentication records at random.

Keep the prior sending route available until acceptance where feasible. Stop expansion if DNS or message identity differs from the provisioning case. Recheck after pod changes, VMTA changes, selector rotation or domain migration. All steps here are documentary guidance; no Acoustic tenant or test message was executed.

[ Takeaway ]

Verify message identities and branded links as separate outcomes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Use the provisioning case to control every owner, record and verification step.

Next steps

  1. Retain organization, pod and the supplied record set.
  2. Verify delegation, active selector and actual Campaign message.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Review delegated DNS scope and preserve evidence for key rotation and supplier retirement.

Next steps

  1. Approve only the intended subdomain delegation.
  2. Review active queues before retiring selectors or reply dependencies.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Approve whether the business needs a From-only identity or a fully branded custom domain.

Next steps

  1. Choose From-only versus custom-domain scope explicitly.
  2. Confirm the provisioning order and specialist handoff.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Can I create a From domain before a custom domain?

The cited Acoustic procedure says a custom domain must exist first.

Acoustic Campaign From domains

Should I follow provisioning steps immediately?

No. Acoustic explicitly requires the order, support case and specialist direction before those changes.

Acoustic Campaign From domains

Who hosts DNS on a multi-client shared IP pool?

The From-domain documentation requires Acoustic-hosted DNS for that arrangement.

Acoustic Campaign From domains

Is there one SPF include for all Acoustic configurations?

Do not assume one. Use the exact record set for your organization, pod and hosting model.

Acoustic Campaign custom domain provisioning

Should I always query spop2048?

Confirm the active selector in provisioning evidence and a real signature. Acoustic also documents spop1024 and transition coexistence.

Acoustic deliverability and performance

Why do authenticated messages still use older branded links?

A From-only configuration can use links associated with the VMTA’s existing custom domain.

Acoustic Campaign From domains

Does an SSL certificate verify email authentication?

No. Link transport security and message-domain authentication are separate controls.

Acoustic Campaign custom domain provisioning

What should trigger another test?

Changes to the domain, pod, VMTA, DNS delegation, reply route or active DKIM selector.

[ Sources ]

Sources

  1. Acoustic Campaign From domains

    Sections Details required to provision a domain · Provision a From domain

  2. Acoustic Campaign custom domain provisioning

    Sections Custom domains vs From domains · SSL certificates · Provision custom domain

  3. Acoustic deliverability and performance

    Sections How do I find the DKIM selector for my Acoustic send domain?

  4. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  7. RFC 1034 DNS concepts

    Sections §3.6.2 Aliases and canonical names · §4.2 How the database is divided into zones

  8. RFC 2308 DNS negative caching

    Sections §5 Caching Negative Answers

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base