[ Sending-service guides ]

Authenticate email sent through MailChannels SMTP Relay: configuration and verification

Configure the MailChannels Outbound Filtering SMTP route, restrict the permitted account, preserve local DKIM signing and prove authentication at the receiving system.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Use the MTA smart-host product with required encrypted SMTP.
  • Treat account authorization and receiver alignment as separate gates.
  • Generate Message-ID before the actual local signing step.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Generate Message-ID before the actual local signing step.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Test the local signing path

The SMTP route relies on the real MTA configuration and message construction.

Next steps

  1. Require TLS and account-specific SMTP authentication.
  2. Use the DKIM guidance for the installed MTA version.
  3. Generate Message-ID before signing and inspect received results.

CISO / SecOps

Restrict shared-service authority

SPF alone cannot distinguish customers using the same relay infrastructure.

Next steps

  1. Review Domain Lockdown account and sender scopes.
  2. Test every intended authorized identity.
  3. Keep provider authorization separate from DMARC evidence.

Founder / Non-technical

Protect every hosted workflow

A relay migration can affect mailbox users, websites and automated applications differently.

Next steps

  1. Inventory the applications behind each domain.
  2. Roll out with a controlled test audience.
  3. Assign an owner for queued-mail recovery.

[ FAQs ]

Frequently asked questions

Does this guide apply to the MailChannels Email API?

No. It covers the Outbound Filtering SMTP smart-host route. API-specific domain and signing instructions must not be imported without checking scope.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I point Outlook or Thunderbird directly at the relay?

The current setup guide says the endpoint is for MTAs. Clients should continue submitting through their own mail server.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What transport protection is required?

The current MailChannels configuration guide requires TLS using STARTTLS with SMTP AUTH. Follow the guide for the actual MTA and allowed port.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why configure Domain Lockdown as well as SPF?

SPF authorizes shared sending infrastructure. Domain Lockdown restricts which MailChannels account or sender identities may send for the domain.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does a version-only Domain Lockdown record allow normal sending?

No. The documented v=mc1 record with no auth or senderid entries blocks all MailChannels sending for that domain.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does MailChannels automatically create DKIM keys for my SMTP domain?

The reviewed cPanel guide describes local Exim signing. It does not establish provider-managed customer keys for every SMTP route; confirm the actual MTA setup.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why can DKIM fail after a missing Message-ID is inserted?

If the original signature signed that header's absence, adding it later invalidates the signature. Generate the header before signing and verify the original evidence.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What evidence proves DMARC alignment through this relay?

A received-message identity table from the exact MTA/application route showing From, envelope, every DKIM identity and trusted receiver results. Live testing and human review remain pending.

Configure your mail server for Outbound Filtering Set up SPF records for MailChannels Outbound Filtering Prevent domain spoofing with MailChannels Domain Lockdown DKIM configuration for cPanel DKIM failure when Message-ID is added after signing RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Configure your mail server for Outbound Filtering

    Sections MTA-only94; TLS108; settings113–124; AUTH146; TLS152; identification170 onward

  2. Set up SPF records for MailChannels Outbound Filtering

    Sections SPF authorization and merge; Domain Lockdown recommendation

  3. Prevent domain spoofing with MailChannels Domain Lockdown

    Sections Identifiers88–108; additive examples113–139; headers144–164

  4. DKIM configuration for cPanel

    Sections Exim transport84–135; taint restrictions120–135; live verification148

  5. DKIM failure when Message-ID is added after signing

    Sections Oversigning75–89; consequences94–97; preferred fix107–108

  6. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  7. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  8. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Smart host
An SMTP relay to which an MTA passes outbound mail for onward delivery.
Domain Lockdown
MailChannels' DNS-based restriction on authorized account or sender identities.
X-AuthUser
A sender-identification header used to attribute mail to a user or application.
Oversigning
A DKIM practice that can protect a header's absence so later insertion invalidates the signature.
Signing point
The place in the mail path where the DKIM signature is computed.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base