[ Sending-service guides ]
Verify ServiceNow email identities across hosted and customer mail routes
Distinguish default ServiceNow signing, support-assisted custom-domain DKIM, and customer-operated outbound routes before approving notifications or changing DNS.
By the EmailAuth research team · 9 min read
[ Key points ]
- Protect critical notifications
- Resolve the final signer
- Require instance-specific evidence
[ Takeaway ]
Distinguish default ServiceNow signing, support-assisted custom-domain DKIM, and customer-operated outbound routes before approving notifications or changing DNS.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Resolve the final signer
ServiceNow-hosted and customer-operated mail need different configuration owners.
Next steps
- Identify the active outbound connection.
- Obtain current support instructions where required.
- Inspect actual receiver identities.
CISO / SecOps
Require instance-specific evidence
Published capability documentation does not prove custom signing is activated.
Next steps
- Keep support and activation gates visible.
- Reject unverified IP or selector recipes.
- Review DMARC and allowlisting changes separately.
Founder / Non-technical
Protect critical notifications
A test in one instance or on one route may not represent production.
Next steps
- Inventory production notification paths.
- Approve a safe test event.
- Keep a known working recovery route.
[ FAQs ]
Frequently asked questions
Does default ServiceNow DKIM cover any custom From domain?
The public support article scopes default signing to service-now.com From addresses and points custom domains to a separate request process.
Is custom-domain DKIM supported?
ServiceNow publicly confirms that capability, but current support instructions and account-specific activation are still required.
Can this guide give me the complete service-catalog procedure?
No. The detailed Now Support article was not accessible in this research. An authorized administrator must supply the current procedure.
Should I reuse the selector from the support example?
No. Read the selector from the actual message or the current provider-issued setup. The example is not a permanent production value.
Should all ServiceNow notifications use a ServiceNow SPF include?
First identify the actual outbound route and evaluated envelope domain. Customer-operated mail may have a different authentication owner.
Does SMTP or OAuth authentication prove DMARC?
No. Submission access and receiver-side domain alignment are different checks.
RFC 9989 Domain-based Message Authentication Reporting and Conformance
Does an email record marked sent prove the recipient accepted it?
No. Preserve actual receiving or rejection evidence and correlate it with the platform record.
What is the scope hold for this article?
The detailed custom-domain setup and SPF instructions, instance-specific records and live message evidence are missing. Public capability confirmation does not close that gap.
[ Sources ]
Sources
- Using DKIM for Emails from the service-now.com Domain
Sections Issue · DKIM selector from email headers · Related Links
- Securing email on the ServiceNow AI Platform
Sections Authentication standards: SPF, DKIM, and DMARC · Leveraging your existing email infrastructure
- RFC 7208 Sender Policy Framework
Sections §4.5 Selecting Records · §4.6.4 DNS Lookup Limits
- RFC 6376 DomainKeys Identified Mail
Sections §3.5 The DKIM-Signature Header Field · §6.1 Extract Signatures from the Message
- RFC 9989 Domain-based Message Authentication Reporting and Conformance
Sections Identifier Alignment · DMARC Policy Discovery
[ Glossary ]
Glossary
- Outbound connection
- The instance configuration that hands a notification to its delivery infrastructure.
- Instance coverage
- The environments and instances to which an approved signing arrangement applies.
- Activation evidence
- Provider confirmation that the intended signing configuration is in use.
- Final signer
- The service responsible for a DKIM signature that survives the complete delivery route.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption