Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Choose the current Ortto email domain
This guide covers the current Ortto custom-domain email route. Begin with the From domain that a recipient should see, the Ortto account that sends the campaign, and the authoritative DNS service. A tracking subdomain identifies links and website activity; it does not replace the email identity. Record whether the intended From address uses the organizational domain or a sending subdomain. The DNS owner needs the exact domain entered in Ortto, not just the organization's homepage.
Ortto distinguishes email-only setup from email plus tracking. Its documentation specifies three CNAME records for email only and four when tracking is included. Obtain the actual set from Settings > Custom domains after adding the intended domain. Multiple Ortto accounts can use the same domain, but each account generates its own authentication records. Do not assume another team's verified account covers yours. Ortto custom domains
Before changing anything, export the existing DNS answers and note other services using the same names. Keep unrelated mailboxes, inbound MX records and website records outside this change. Ask the campaign owner to provide a harmless representative message and an approved test recipient. The acceptance target is a specific working route, not a green status somewhere in the organization.
Publish the generated records at the authoritative DNS host
Copy each owner, record type and target exactly as issued. When the DNS editor appends the zone automatically, enter only the required relative owner. When it expects a fully qualified name, enter the full owner. For a sending subdomain, ensure the owner still contains that subdomain once. Compare the resulting published name with Ortto's requested name, rather than judging the text entered into the form.
Ortto's troubleshooting guidance describes duplicated domain suffixes and mismatched CNAME values as failure causes. A CNAME owner cannot simultaneously carry conflicting records. If an existing service occupies a requested name, stop and resolve ownership rather than deleting it blindly. For Cloudflare DNS, Ortto directs users to set the CNAME proxy mode to DNS only. DNS registration and authoritative DNS hosting can be different services. Ortto custom domain troubleshooting Ortto custom domains
Query the authoritative answer for every requested name and preserve the observed target and timestamp. A screenshot of an inactive zone is insufficient. Recheck through a recursive resolver after the applicable cache lifetime. Repeatedly deleting and re-adding the domain while propagation is incomplete can make the expected record set harder to track.
Keep optional SPF separate from DMARC alignment
Ortto describes its additional SPF configuration as recommended rather than mandatory for custom-domain setup and email auto-forwarding. Do not paste its complete example over an existing policy: that example also includes another mailbox provider. If a justified SPF change is needed, incorporate the applicable authorization into the single policy at the correct envelope domain, retaining other legitimate senders and checking RFC7208 §4.6.4’s ten evaluated DNS-causing-term limit, including nested evaluation. Ortto custom domains
SPF evaluates the SMTP identity, not simply the visible From address. DKIM verification uses the signature's signing domain and selector. For DMARC, a passing mechanism must also align with the visible From domain under the applicable alignment mode. A passing provider-domain SPF result alone does not prove your custom From domain is authenticated. Record both outcomes from the receiver instead of assuming the CNAME wizard proves every later message. SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989
Distinguish pending email from pending tracking
Run Verify setup for the intended custom domain. Ortto documents different fallback behavior for an unverified sending domain and an unverified tracking subdomain. An email-domain problem can cause provider-domain sending, while a tracking problem can leave custom-domain sending intact. Certificate pending or expired also leaves custom-domain email sending available while clicks and opens use the default tracking domain until certificate approval. Treat those as separate acceptance checks. Ortto custom domains
After verification, send through the same campaign or automation that will be used in production. Save the visible From domain, SMTP MAIL FROM or Return-Path, DKIM d= and s= values, and the trusted receiver's Authentication-Results. Check the received message rather than a preview. Separately inspect a safe tracking link if tracking is in scope. A successful HTTPS link is not DKIM evidence, and DKIM passing does not prove the tracking certificate is ready.
Handle an Autopilot migration as a new verification event
Ortto's troubleshooting article warns that domains verified in Autopilot do not automatically become verified for Ortto after account unification. Its remediation can involve removing and re-adding the domain to obtain new CNAME values. Plan this as a controlled change, with a record of the existing configuration and a business-approved sending window. Do not reuse a legacy Autopilot SPF or selector recipe as a current Ortto prescription. Ortto custom domain troubleshooting
If a domain was previously verified and now fails, compare the current authoritative records with the account-issued set before regeneration. Ask whether a DNS migration, proxy setting or removed record changed the path. Preserve evidence for support. Avoid bulk resending while diagnosing: recipient suppression, consent and complaint history are separate from domain authentication.
Route-specific acceptance worksheet
Use one worksheet per Ortto account and sending domain. These fields are proposed acceptance checks, not observations from a live tenant.
- Account and workflow: account owner, campaign or automation name, intended From domain, and whether this is migrated Autopilot traffic.
- Record inventory: each generated CNAME owner and target, authoritative DNS provider, current published answer and collection time.
- Feature boundary: email only or email plus tracking; tracking subdomain and certificate status recorded separately.
- Sender result: actual received From domain, envelope domain, DKIM signing domain and selector, receiver authentication results and alignment mode.
- Fallback decision: whether provider-domain fallback is permitted temporarily, who approves it, and how recipients will recognize the sender.
- Acceptance and recovery: operator, change ticket, controlled-message evidence, rollback trigger and owner sign-off.
Fictional diagnosis of a misleading green tracking setup
This example is fictional. A marketing team migrates to Ortto and sees its tracking links working. A test campaign arrives from a provider domain instead of news.example.com. The administrator initially assumes SPF is missing and proposes replacing the company's root policy.
The evidence points elsewhere: the campaign account shows the custom sending domain pending, while tracking is configured. The team compares account-issued CNAMEs with DNS and discovers legacy Autopilot records. It stages the current records, re-runs domain verification, and tests the same campaign again. The desired result is a message with the intended From domain and an aligned passing mechanism. That result must be observed; it is not guaranteed by this fictional sequence. Root SPF replacement and a weaker DMARC policy are not justified by the initial symptom.
Release and review gates
This is a documentation-based procedure. Current account records, authoritative DNS, receiver headers, human SME approval and visual review remain pending. Do not describe the organization as authenticated until the worksheet has evidence for each intended route. Preserve the source date and reassess after account migration, domain regeneration or DNS-host changes. Publication approval is separate from completing this draft.