[ Sending-service guides ]

Authenticate email sent through Adelante: configuration and verification

Apply Adelante’s documented SPF IP guidance carefully, while keeping unverified DKIM and alignment capabilities explicit.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Apply Adelante’s documented SPF IP guidance carefully, while keeping unverified DKIM and alignment capabilities explicit.
  • An old documented IP is a verification lead, not current production authorization.
On this page

The Adelante provider in this guide is Adelante Software's go2pay.uk payment platform. Its official Emails & SPF documentation concerns messages such as payment links sent on a customer's behalf. Do not confuse this service with an unrelated company that shares the Adelante name.

The retained first-party page captured for the earlier documentary review identifies an April 2022 update. It supplies a sending IP and does not establish current custom DKIM or custom Return-Path capabilities. This guide therefore provides a bounded SPF configuration and verification method. It does not claim a fully demonstrated DMARC-capable Adelante route.

Confirm the documented sender before changing DNS

The official page asks the customer's IT team to incorporate 37.35.91.34 into the SPF DNS record. Adelante Emails & SPF

Because the page is old, confirm that this IP still applies to the payment product and account in use before production publication. A successful retrieval of a documentation page does not prove that its sending infrastructure has remained unchanged. Obtain the actual envelope identity from a controlled received payment-link email or current provider guidance, then identify the SPF owner name that receivers evaluate.

An IPv4 address is authorized with an SPF ip4: mechanism. It is not converted to an include: term: include evaluates another domain's SPF policy. Do not infer that a numeric-looking include means an IP authorization. Preserve existing authorized senders in the one policy at the relevant name and place any new mechanism before the terminal all term. SPF specification

Build a narrow proposed change

Illustrative syntax only, conditional on current provider confirmation and the observed SPF identity: an existing v=spf1 include:mail.example.net -all policy could become v=spf1 include:mail.example.net ip4:37.35.91.34 -all. The example include domain is invented, not an instruction to publish it. The exercise shows preserving another authorization and the policy's terminal qualifier while adding an IP mechanism.

Capture the before-and-after DNS diff, the business owner, confirmation of current service use and the planned test. Do not modify the apex merely because it appears in the visible From address if the actual SPF identity is elsewhere. Do not change receiving MX records: the cited Adelante page does not call for that action.

Do not turn an SPF pass into an unsupported DMARC claim

After an authorized test through the real payment-link workflow, record visible From, envelope identity and SPF result, every DKIM signature's domain and receiver result, and DMARC outcome. SPF must both pass and align to contribute to DMARC. If it authenticates an unrelated provider domain, adding authorization to your visible From domain does not necessarily change that identity.

The reviewed source does not supply a custom DKIM selector or activation workflow. Do not invent either, and do not state that DKIM is unsupported merely because this page omits it. If neither aligned SPF nor aligned DKIM can be demonstrated, hold the branded sending configuration and ask for the supported solution. A provider-owned From address with a suitable reply route may be a design option to discuss, not a documented Adelante feature here.

Recover and retain the evidence boundary

Pause the affected mail workflow if the change causes failures. Restore the prior policy if appropriate while the service owner resolves the route, rather than publishing +all or weakening domain-wide DMARC to conceal a mismatch. Retain the documentation age, provider response and redacted received-message evidence. No real Adelante message, DNS change or payment transaction was executed for this article.

Use a two-part go or hold decision

The proposed change needs both current service confirmation and a controlled identity sample. Record who confirmed the address, which payment product and account it applies to, and when. Separately record the real envelope and aligned passing path. If either row is unknown, hold production authorization rather than treating documentation age or an old policy as proof. This decision card is a proposed safeguard, not a provider response or a performed payment test.

[ Takeaway ]

An old documented IP is a verification lead, not current production authorization.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Confirm the current IP and SPF identity, then retain the minimal policy diff and received-message results.

Next steps

  1. Confirm the actual envelope identity before selecting the SPF owner.
  2. Retain the existing policy and proposed minimal diff.
  3. Capture trusted receiver results from the approved payment-link route.

CISO / SecOps

Govern the remaining exposure

Track custom-signing and envelope-domain support as unresolved questions, without inventing either support or non-support.

Next steps

  1. Record custom-signing and envelope support as unanswered until confirmed.
  2. Require an owner for unresolved authentication exceptions.
  3. Review obsolete IP authorizations when the service is retired.

Founder / Non-technical

Own the sending outcome

Keep payment-link delivery under a named business owner and avoid changing live billing mail from an old documentation page alone.

Next steps

  1. Name the owner of payment-link delivery.
  2. Require current provider confirmation before a production DNS change.
  3. Keep any affected billing workflow under an approved continuity plan.

[ FAQs ]

Frequently asked questions

Which Adelante is covered?

Adelante Software’s go2pay.uk service, whose official documentation discusses payment-link emails.

Is 37.35.91.34 a newly verified sending observation?

No. It is the IP documented in the retained official page, last updated in April 2022. Confirm its current applicability before use.

Should I write include followed by that IP?

No. Use the SPF ip4 mechanism for an authorized IPv4 address; include references another domain’s SPF policy.

Can I replace the whole SPF record?

Preserve other legitimate senders and the intended policy. Review a narrow diff at the actual SPF identity.

Does this source prove custom DKIM is unavailable?

No. It does not document that capability, so support status remains unverified.

Does authorizing the IP guarantee DMARC passes?

No. SPF must authenticate an identity aligned with the visible From, or aligned DKIM must pass.

Should I change MX records?

The cited official page does not instruct that change. Do not alter receiving mail as part of this bounded SPF task.

What evidence closes the remaining gap?

Current provider confirmation for the account and a received message showing the real authenticated identities and DMARC result.

[ Sources ]

Sources

  1. Adelante: Emails and SPF

    Sections First-party identity Adelante Software Ltd; last update April 2022; IP 37.35.91.34. No DKIM or custom Return-Path instructions established.

  2. RFC 9989: DMARC

    Sections Identifier alignment and DMARC validation; receiver discretion.

  3. RFC 7208: SPF

    Sections Sections 3.2, 4.6.4, 5.2, 5.6: single record, lookup budget, include and ip4.

  4. RFC 6376: DKIM

    Sections Sections 3.5, 3.6 and 6: d and s identifiers, DNS key retrieval and verification.

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base