[ Sending-service guides ]

Authenticate email sent through Acquia Cloud: configuration and verification

Configure Acquia Platform Email for the actual Drupal application, then verify its sending identities rather than reusing legacy DNS.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Verify the email domain separately from the website domain.
  • Associate the verified domain with the actual Drupal application.
  • Retire the legacy SPF dependency without deleting other authorizations.
On this page

Provider documentation checked on 8 November 2026. Account-generated values and current product support remain deployment prerequisites.

Acquia Cloud hosting and Acquia Platform Email are related but different configuration tasks. This guide covers the current Platform Email route for a Drupal application, not every SMTP module that might run on that website. An application using a separate SMTP supplier needs that supplier's authentication instructions instead.

Register the email domain in the right place

References: RFC 6376 §3.6.2.

Start with the Cloud Platform application and its Email area. On Domain Verification, use Add Domain for the intended sending domain. Website Domain Management is not the email-domain configuration screen. Acquia lists owner or administrator permissions for domain configuration and owner permission for application association. Arrange DNS access and a Drupal administrator before beginning.

Copy the records generated for this domain into its authoritative DNS service. Acquia's workflow verifies the records and then allows the verified domain to be associated with an application. Associate it with the application that will actually send the messages. Configure the Drupal site email address under Configuration, Basic site settings, Site Details. For a custom mail-system module, the documented Platform Email path requires Default PHP mailer as Sender; this is not a requirement for a separately chosen external SMTP route. These are distinct steps: a verified domain that is not used by the application does not prove the application's outgoing route is authenticated. Acquia configuration

Avoid the legacy SPF trap

References: RFC 7208 §4.5.

Acquia's February 2025 support notice says the legacy email service was removed and its _spf.acquia.com dependency is no longer required. Do not add that historical include to a new Platform Email configuration. If it is already present, review the full SPF policy and the migration evidence before removing only the obsolete term. Do not replace unrelated mail-service authorizations. Legacy SPF notice

Use the current generated records for the selected domain. Do not copy another customer's SES targets or move the corporate domain's receiving MX records to a guessed destination. Preserve the exact owner names and record types supplied by the service.

Test a Drupal transaction, not just a console status

References: RFC 9989 §4.4.

Original verification plan: trigger a harmless notification using the application's normal delivery path and a mailbox you control. Record the visible From domain, SPF identity and result, DKIM d= and s= values and verification result, and the receiving system's DMARC result. Compare the authenticated domains with the visible From domain under its alignment policy. A DNS verification badge is evidence of setup, not a received-message result.

Illustrative failure: a site verifies news.example.com in Platform Email, but its form module uses another SMTP service. The mail can leave successfully while authenticating a different domain. Correct the selected transport or authenticate that separate supplier; repeatedly adding Platform Email records cannot change the other supplier's signer.

Recover without breaking another application

Keep the previous configuration, application association and DNS values in the change record. If test mail fails, pause the affected workflow, inspect Drupal transport configuration and restore the previously verified route if it remains available. Check whether the domain is shared with other applications before dissociating or deleting it. Do not delete verification records merely because one test failed.

This is documentary setup guidance. No Acquia tenant, DNS zone or real message was tested for this article. Completion requires a saved application-specific received-message table and a named owner for any exception.

[ Takeaway ]

Retire the legacy SPF dependency without deleting other authorizations.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Document domain verification, application association and Drupal transport as three separate checkpoints.

Next steps

  1. Document domain verification, application association and Drupal transport as three separate checkpoints.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Review shared-domain dependencies before retirement and retain evidence of the authenticated identity used by each application.

Next steps

  1. Review shared-domain dependencies before retirement and retain evidence of the authenticated identity used by each application.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Tie release approval to a tested business notification, such as a form acknowledgement, not a green DNS badge.

Next steps

  1. Tie release approval to a tested business notification, such as a form acknowledgement, not a green DNS badge.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Does adding the website domain configure email?

No. Acquia distinguishes website Domain Management from the Platform Email domain configuration.

Acquia: Configuring Platform Email

Can I keep using the old Acquia SPF include?

Do not add it for current Platform Email. Acquia says its legacy dependency is no longer required; review existing use before removing that term.

Acquia: SPF record error for Platform Email

Who associates the verified domain?

Acquia lists the owner role for application association. Domain configuration and association have different prerequisites.

Acquia: Configuring Platform Email

Does this cover an SMTP module using another vendor?

No. Identify and authenticate that vendor route separately.

Acquia: Configuring Platform Email

Should I copy SES records from a sample?

No. Publish the records shown for your actual Platform Email domain.

Acquia: Configuring Platform Email

What message should I test?

A representative notification sent through the real Drupal application transport, to a mailbox you control.

Why can verification pass while mail is wrong?

The application can use another transport, another From domain or an association different from the one you verified.

Can I delete the domain to troubleshoot?

First inspect every application association and preserve a recovery plan. Deletion is not a substitute for diagnosing the sending route.

Acquia: Configuring Platform Email

[ Sources ]

Sources

  1. Acquia: Configuring Platform Email

    Sections Prerequisites · Configuring a domain · Associating a domain to an application · Configuring the email address for sending emails · Deleting a domain

  2. Acquia: SPF record error for Platform Email

    Sections Issue · Resolution · Cause

  3. RFC 9989: DMARC

    Sections §4.4.1 DKIM-authenticated identifiers · §4.4.2 SPF-authenticated identifiers · §4.10 DNS tree walk and duplicate policy records · §5.3.5 Determine DMARC pass or fail

  4. RFC 7208: SPF

    Sections §3.2 Multiple DNS records · §4.5 Selecting records · §4.6.4 DNS lookup limits

  5. RFC 6376: DKIM

    Sections §3.3 Signing and verification algorithms · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base