[ Sending-service guides ]

Configure SPF and DKIM for N-able Mail Assure outgoing filtering

Authorize the real outbound route and activate the generated selector on the matching outgoing authentication method.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Protect the Mail Assure change window
  • Keep Mail Assure configuration evidence reproducible
  • Require scoped assurance for Mail Assure
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Authorize the real outbound route and activate the generated selector on the matching outgoing authentication method.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Keep Mail Assure configuration evidence reproducible

Separate the DNS values, sender settings and received-message results.

Next steps

  1. Capture previous records and exact account scope.
  2. Compare authoritative answers with the issued worksheet.
  3. Keep the exact route and selector in the evidence record.

CISO / SecOps

Require scoped assurance for Mail Assure

Documentation alone does not prove the organization’s live mail is authenticated.

Next steps

  1. Retain provider scope and human review gates.
  2. Reject unsupported authentication guarantees.
  3. Review residual risk before removing the release hold.

Founder / Non-technical

Protect the Mail Assure change window

Make outbound route ownership explicit before moving mail through a filtering service.

Next steps

  1. Name the business owner and pause authority.
  2. Require a controlled acceptance test before broad rollout.
  3. Budget time for the provider and DNS owner to resolve exceptions.

[ FAQs ]

Frequently asked questions

Which SPF include does Mail Assure document?

The general outgoing-filtering guide documents include:spf.mtaroutes.com. Apply it only to the appropriate envelope-domain policy and preserve other legitimate sources.

Mail Assure SPF setup

Should I choose an EU-only include automatically?

No. Regional variants depend on the configured domain region and are not the default recommendation.

Mail Assure SPF setup

Does generating a DKIM key enable signing?

Not by itself. The matching selector must be configured on the relevant outgoing authentication method. N-able conditions signing with that selector on the message not already having its own DKIM; inspect the final signatures before treating an absent added signature as a fault.

Mail Assure DKIM generation

Can a re-authenticating user use Mail Assure DKIM signing?

The current DKIM page says signing is unavailable for that method. Evaluate a supported upstream signer and verify the result.

Mail Assure DKIM generation

What key length does the guide recommend?

N-able recommends 2048 bits where the DNS service accepts it.

Mail Assure DKIM generation

Does inbound protection prove outbound authentication?

No. Test the outgoing route used by each important workflow.

Mail Assure outgoing filtering

Can SPF pass while DMARC fails?

Yes. The SPF identity can be unaligned, and DKIM may also be missing, failing or unaligned.

DMARC RFC 9989

What is the acceptance evidence?

Authoritative DNS answers plus a recipient message showing the intended aligned passing path, with the account method and selector recorded.

[ Sources ]

Sources

  1. Mail Assure outgoing filtering

    Sections Mail Assure outgoing filtering

  2. Mail Assure SPF setup

    Sections Mail Assure SPF setup

  3. Mail Assure DKIM generation

    Sections Mail Assure DKIM generation

  4. SPF RFC 7208

    Sections SPF RFC 7208

  5. DKIM RFC 6376

    Sections DKIM RFC 6376

  6. DMARC RFC 9989

    Sections DMARC RFC 9989

[ Glossary ]

Glossary

Authoritative DNS
The servers responsible for publishing the domain’s DNS data.
Envelope domain
The SMTP sender domain evaluated by SPF.
DKIM selector
The label identifying a public key under the signing domain.
Alignment
The required relationship between the visible From domain and a passing authentication identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base