Source review dated 8 November 2026. This is documentary guidance; account, DNS and received-message acceptance tests below have not been executed.
Select the email product before selecting DNS records
The NICE inContact name now appears in NiCE CXone documentation. This guide covers hosted email routed through ACD, not Digital Experience email. NiCE's ACD setup page explicitly directs Digital Experience customers to a different documentation path. A contact-center brand name is not enough to determine which domain controls or transport configuration apply. NiCE CXone: Set Up Email for ACD
The current CXone System Email guide distinguishes ACD channel messages, platform system notifications and integrated-product messages. It also distinguishes Amazon SES-verified ACD domains from unverified domains using a separate email system. Therefore, a password-reset email, a scheduled report and an agent's customer reply are not interchangeable authentication test samples. NiCE CXone User Hub System Email
Before touching DNS, record the tenant, region, division where applicable, product channel, sending domain and ACD skill. Ask the contact-center administrator to confirm the route the business actually uses. If the task concerns Digital Experience, an integrated product or a custom transport not covered by these sources, stop this recipe and obtain that product's instructions. Do not apply an ACD selector to a different channel by analogy.
Keep inbound routing separate from outbound identity
An ACD point of contact and skill determine how interactions reach agents; DNS authentication determines what receivers can validate about outbound mail. Changing MX records or routing a production inbox is a broader intervention than publishing a verification token or DKIM delegation. Scope the approved change so that an authentication correction cannot silently redirect inbound customer messages.
Prepare a harmless outbound test that uses the actual skill and From domain. If both an agent reply and a proactive outbound workflow matter, define two tests. Avoid customer addresses and real case content. The test record should explain which platform action generated each message, because identical-looking email templates may travel through different systems.
Verify the domain and generate the issued DKIM records
For ACD hosted email, NiCE documents ACD > Contact Settings > Email Domains. Domain verification uses the Verification Key and a DNS TXT record. DKIM generation is a separate Action operation that opens Dkim Tokens (CNAME), from which the administrator downloads a CSV and publishes the supplied records. Domain Verification Status, Email Domain Status and DKIM Status are different fields. An Active domain indicates use by a skill, not successful cryptographic verification. NiCE CXone: Set Up Email for ACD
Copy the account's exact domain-verification owner/value and every DKIM CSV row into the change worksheet. Record the fully qualified owner separately from the DNS editor's host input, especially where the editor appends the zone. Publish a DNS TXT record as a record; a local text file is not itself a DNS update. Do not derive a token from a documentation example or from another tenant.
Treat the generated CSV as the source of truth for the public CNAME data, subject to account verification. Do not guess a selector count or target suffix. Check for an existing record at each owner and confirm it is safe to add or change. Preserve other senders' selectors. When a CNAME delegates the key to a provider-managed target, verify both the customer-side alias and the resulting public key resolution. DKIM RFC 6376 DNS RFC 2181
Return to Email Domains after publication. Save the domain-verification and DKIM status results separately. If verification fails, compare the published record with the issued data before initiating another attempt. A domain can be known to the system without the intended DKIM state being complete; the final acceptance evidence is still a message from the selected route.
Choose SPF authorization by route and region
NiCE's current System Email page provides separate inbound allow-list and SPF sections. Its SPF instructions concern unverified ACD channel domains and provide region-specific sending addresses. The inbound allow-list contains additional infrastructure and is not a list to copy wholesale into a customer SPF policy. Record the account's region and domain-verification state before choosing authorization. NiCE CXone User Hub System Email
For an SES-verified route, use its current supported configuration and observe the actual envelope identity. Do not infer a universal include or custom return-path capability from the word SES alone. The sources reviewed here do not establish a tenant-independent custom envelope setup. If SPF alignment is a requirement, ask for the supported option and account-issued records rather than changing the visible From policy without evidence.
Keep one candidate SPF policy per evaluated envelope owner and preserve existing legitimate sources. An SPF pass for a provider envelope can be unaligned with the visible From domain, while an aligned passing DKIM signature can satisfy DMARC. Keep receiver results and identities together, including the applicable alignment mode. SPF RFC 7208 DMARC RFC 9989
Reusable ACD route worksheet
Complete one worksheet per From domain and actual skill/workflow. Use unknown where evidence is missing and hold dependent changes.
- Tenant, region and contact-center owner: ______.
- Product: ACD hosted email / Digital Experience / integrated product / other ______.
- ACD skill, direction, From address and controlled test action: ______.
- Domain Verification Status before/after: ______ / ______.
- Email Domain Status before/after: ______ / ______. Why this is not a DKIM verdict: ______.
- Verification TXT fully qualified owner, editor input and issued value: ______.
- DKIM CSV issue date and account/domain association: ______.
- Each CSV owner, type, target and prior record at that owner: ______.
- DKIM Status before/after and validation timestamp: ______ / ______.
- Route: SES verified / legacy unverified / unconfirmed. Evidence: ______.
- SPF authorization source section, region and evaluated envelope owner: ______.
- Authoritative responses and recursive-cache differences: ______.
- Observed From, Return-Path, every DKIM d/s and trusted results: ______.
- Aligned passing identity and DMARC result: ______.
- Separate inbound/reply-routing check and result: ______.
- Decision: release tested skill / fix verification TXT / fix DKIM CNAME / fix activation / request route instructions / hold.
- Saved records, pause authority, recovery trigger and reviewer: ______.
Fictional worked diagnosis
This example is fictional; it reports no real CXone message or DNS test. An administrator sees Email Domain Status Active and assumes DKIM is configured. A controlled agent reply from support@example.org arrives with SPF pass on a provider envelope, no aligned passing DKIM signature and DMARC fail. The worksheet shows Domain Verification Status Success but DKIM Status Failed.
The proposed diagnosis is incomplete DKIM setup, not an inactive skill. Comparing the issued CSV with authoritative answers reveals that one owner was entered with the zone suffix twice. The proposed repair corrects that owner, rechecks the CNAME/key path, verifies DKIM Status and repeats the same agent-reply test. Adding every address from the system-notification allow-list would not repair the wrong selector owner. Testing a password-reset email would not validate the agent route either.
Close the evidence gap before broad rollout
Capture authoritative DNS answers before and after the approved change. After platform validation, preserve the raw controlled message and trusted receiver Authentication-Results. Record the individual d and s values if there are multiple DKIM signatures. If a signature is present but fails, investigate key resolution and message modification rather than merely repeating domain verification.
Keep the old record set and account configuration with a named recovery owner. Coordinate any rollback with the contact-center team so that DNS and active signing do not diverge. Avoid altering unrelated channel settings or inbound routing while diagnosing an outbound-authentication failure.
No live CXone account walkthrough, visual UI verification, authoritative before/after test or independent received-message test was performed. Human SME approval remains open. Digital Experience, integrated-product and unverified custom-envelope instructions are outside this established setup scope and require their own first-party evidence.