Select the current product and delivery method
This guide covers the HappyFox Help Desk Managed outgoing-email workflow documented in October 2026. It does not substitute older Help Desk or Service Desk instructions, and it does not apply these records to a custom SMTP route. Record the account, email channel, hosting region, intended From domain and actual outgoing method before opening DNS.
The current SPF and DKIM guides list all plans except Basic. Confirm that your account has the relevant workflow. Under Channels > Email > Email Addresses, open the channel, choose Configure for HappyFox Managed and use DNS Verification. The SPF panel supplies one TXT record and an alignment CNAME; the DKIM panel supplies five CNAME pairs. SPF setup · DKIM setup
Publish the entire displayed record set
Copy the account's exact values and distinguish the SPF and DKIM panels on the change worksheet. For an existing root SPF policy, merge the approved HappyFox include into that policy, preserving other senders. Do not create a second SPF policy. Select the account-appropriate authorization rather than combining US and EU examples without a reason. Publish the alignment CNAME and every DKIM pair; on Cloudflare, the provider instructs DNS-only records. Current publication instructions
Verify each intended full owner name. If the DNS host appends the domain, use the relative name that produces the correct owner rather than duplicating the zone suffix. Inspect any existing data before adding a CNAME. Preserve the previous approved answers and determine dependencies before replacing records or removing legacy selectors.
Run Verify SPF Records, then Verify and Enable DKIM in the applicable panels. The documentation allows up to 72 hours for verification. It also warns that without completed DKIM verification this Managed workflow sends from a generic HappyFox address rather than the custom domain. Current DKIM verification
Distinguish verification from message identity
Original acceptance plan: create a harmless controlled support exchange for the actual channel. Capture a normal reply and any automated response included in the rollout. For each, record the displayed From domain, SMTP envelope domain, DKIM d= and s= values, and trusted receiver-added authentication results. Record whether the observed sender is the intended custom identity or a fallback.
DMARC passes when at least one passing SPF or DKIM identity aligns with the visible From domain under the applicable policy. A generic fallback may authenticate as its own domain without proving that your custom-domain rollout is complete. Likewise, a successful DNS panel does not by itself prove that the message used the expected channel or delivery method.
Illustrative failure: an administrator follows an older two-CNAME article while the current panel requests five records. The useful correction is to reconcile the complete current account record set, not to repeatedly test the partial legacy configuration. If the account genuinely has a different interface, obtain product-specific support guidance before mixing workflows.
Close with a controlled recovery plan
Review existing DMARC policy separately with the domain owner; do not copy legacy descriptions of policy modes or weaken enforcement to conceal an incomplete setup. Pause the affected custom-domain rollout if tests fail. Retain the last approved channel settings and DNS records, and change only the layer demonstrated to be wrong. Keep old valid selectors until dependent routes and queued mail are considered.
Documentation was reviewed on 8 November 2026. No HappyFox account, DNS record or real support message was tested. The example and acceptance plan are original illustrative guidance, not a claim of completed activation.
Do not close a channel on partial verification
Written case HF-01 assumes a non-Basic Managed channel intends support@example.com. Its SPF panel passes but only two of the five current DKIM CNAME pairs are published; DKIM activation remains incomplete. The documented generic-sender fallback can apply, but its exact address and message results are unknown here. The channel owner should keep custom-domain acceptance pending while the DNS administrator reconciles all five generated owners and targets, then run Verify and Enable DKIM and inspect a harmless support exchange. Do not infer a DKIM failure from a record count alone or claim any received-message verdict. No support ticket, DNS modification or channel activation was executed.
Preserve the enforcement boundary
RFC 9989 Section 7.4 requires valid DKIM, not SPF alone, for domains publishing p=reject, and warns about indirect-mail and mailing-list interoperability. A single successful direct-message test is not proof that every legitimate route is ready for stronger policy. Keep existing approved protection while diagnosing the actual gap; any policy change needs its own decision.