[ Sending-service guides ]

Authenticate Paubox encrypted email with SPF and domain specific DKIM

Add Paubox to the authorized sending route, enable the issued DKIM key after DNS publication, and test authentication separately from encryption.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Separate encryption, domain authentication and compliance assessment.
  • Merge the documented SPF authorization without losing other senders.
  • Publish domain-specific DKIM before enabling signing.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Publish domain-specific DKIM before enabling signing.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the domain actually used

The selected DKIM domain must match the intended sending workflow.

Next steps

  1. Merge SPF without dropping legitimate senders.
  2. Publish the issued key before enabling signing.
  3. Check trusted receiver results for each domain and route.

CISO / SecOps

Keep assurance claims bounded

Encryption, DMARC and healthcare compliance are distinct assessments.

Next steps

  1. Review routing exceptions and evidence access.
  2. Require separate encryption and authentication acceptance.
  3. Hold production approval until human review is complete.

Founder / Non-technical

Protect confidential communications

Reliable authentication and protected delivery need separate evidence.

Next steps

  1. Define the business-critical mailbox and application routes.
  2. Use harmless pilot content rather than real patient data.
  3. Assign owners for delivery continuity and compliance review.

[ FAQs ]

Frequently asked questions

Does encryption prove DMARC passes?

No. Test the authenticated domains and their alignment separately from encryption.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Which SPF include does Paubox document?

Its email-platform guidance specifies include:_spf.paubox.com. Confirm the applicable route and preserve other legitimate authorization.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Should I add a second SPF TXT record?

No. Maintain one SPF policy at the relevant DNS owner.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Can I reuse another account’s DKIM key?

No. Publish the values issued for your selected account and domain.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

When should DKIM signing be enabled?

The documented sequence publishes the issued DNS record before enabling DKIM Email Signing.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Does a DMARC pass establish HIPAA compliance?

No. Authentication results do not establish the organization’s overall compliance.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Should the pilot contain patient information?

No. Harmless synthetic messages can test identity and routing without exposing patient data.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

Does one mailbox test cover every application?

No. Applications, aliases and alternate delivery routes need their own evidence.

DNS: Creating or updating your domain host TXT/SPF record DNS: Creating a DKIM record User guide: Paubox email encryption RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain-based Message Authentication Reporting and Conformance

[ Sources ]

Sources

  1. DNS: Creating or updating your domain host TXT/SPF record

    Sections Merge41–52; provider-specific examples59–62

  2. DNS: Creating a DKIM record

    Sections Recommended not mandatory19; generate/publish/enable24–32; TXT splitting53

  3. User guide: Paubox email encryption

    Sections Automatic encryption21; recipient TLS/secure message center24–25; compliance claims not adopted

  4. RFC 7208 Sender Policy Framework

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DomainKeys Identified Mail

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 Domain-based Message Authentication Reporting and Conformance

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Transport encryption
Protection applied to a connection carrying message data.
SPF include
A mechanism that evaluates another domain’s SPF authorization within the current policy.
Signing domain
The domain identified by d= in a DKIM signature.
Alignment
The DMARC relationship between an authenticated domain and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base