[ Sending-service guides ]

Webpower authentication: the Spotler MailPro route

Follow the verified Webpower-to-MailPro documentation trail while keeping local-domain infrastructure, visible sender selection and actual authenticated identities separate.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Webpower product continuity is verified for Spotler MailPro, not every Spotler product.
  • A main-domain Sender setup and a local-domain DNS bundle are different procedures.
  • License-specific DKIM aliases, domain verification and provider activation are distinct steps.
  • The actual SMTP envelope and received-message alignment remain unobserved.
On this page

Start with the product and the domain decision

Webpower's current documentation trail leads to Spotler MailPro. The official rebranding page explicitly identifies MailPro as the continuing Webpower marketing automation product. That connection permits a product-specific guide; it does not make the instructions interchangeable with Spotler Mail+, SendPro or every account that once used the Webpower name. Confirm the actual license and interface before planning implementation.

This article uses public instructions reviewed on 9 November 2026. It concerns selecting an authorized sending identity within MailPro, preparing the corresponding DNS changes and collecting evidence from the real campaign path. No account was inspected and no records or messages were tested. The first decision is whether the visible sender uses a dedicated local domain or the organization's main domain, because those choices have different dependencies.

Separate the local domain from the visible address

MailPro's local-domain explanation describes an organization-owned domain or subdomain supporting technical elements such as links and pages. It distinguishes that role from the sender-domain setting. A main-domain sender can still depend on a separately configured local domain. Identify each name and its owner rather than putting every domain into one “authenticated” column.

The page also uses “Mail-From” terminology. Do not translate that wording directly into a claim about the SMTP envelope emitted by a particular campaign. Record the visible From address, intended reply handling, link domain and actual envelope identity as separate fields. The first three can be reviewed during preparation; the last requires suitable route documentation or a received-message observation. Product labels are not a substitute for protocol evidence.

Choose the appropriate setup branch

For the main-domain branch, the Sender domain instructions require an existing local domain and access to the Setup function. They specify two license-specific DKIM CNAMEs, verification through an address on the chosen domain and a final provider configuration step. These settings affect the license, not just the campaign currently displayed. The verification recipient must have the documented account access.

Treat that breadth as a change-management requirement. List the campaigns using the license, identify their owners and decide when a change can be accepted or reversed. Prepare the exact domain and license-specific targets, but do not send a verification email or request activation without authorization. Additional local-domain provisioning may involve a commercial decision; this article establishes neither entitlement nor price.

Do not apply local-domain records to unrelated infrastructure

The separate Sender addresses page supplies a preferred local-domain record bundle, including A, MX, SPF, DKIM and DMARC examples. That bundle is not a universal prescription for the organization's main domain. An A change can affect website routing; an MX change can affect inbound mail. Establish the purpose of the selected domain and existing dependencies before including either in a change.

The configuration map below distinguishes the documented branches. Its DKIM destinations contain the actual license name, which must come from the intended account. A placeholder, another customer's value or an old selector from an unrelated tutorial cannot establish that relationship. Under RFC 6376, section 3.6, verification uses the selector and signing domain to retrieve public key material; a DNS alias alone does not prove that an outgoing message was signed.

Evaluate SPF and DMARC at the correct identities

Before proposing an SPF edit, determine which domain's policy the outgoing route actually evaluates. SPF normally concerns the SMTP MAIL FROM identity, not whichever address a mail client prominently displays. If a change is needed, preserve legitimate existing authorization and evaluate the combined policy's DNS-querying terms. RFC 7208, sections 2.4 and 4.6.4 supplies the protocol basis. Do not publish another independent SPF policy at the same name.

Assess DMARC separately. Its authentication result depends on a passing SPF or DKIM path that aligns with the visible From domain, as defined in RFC 9989, section 4.4. Both mechanisms need not pass for that result. A policy example is not authority to replace existing enforcement, and adding a policy without an appropriate report destination does not automatically create a reporting process. Keep disposition, alignment and reporting decisions distinct.

The provider's 24-hour DKIM TTL recommendation is a documented setting preference, not a promise that every resolver or mailbox provider will behave identically. Nor does waiting a day prove successful authentication. Preserve existing policy and DNS evidence, obtain approvals for the specific differences, and verify outcomes instead of treating elapsed time as acceptance.

Collect a campaign-specific acceptance record

An acceptance table should identify the license, selected Sender address, campaign workflow, time, receiving system and evidence location. Add the observed From domain, envelope identity, all DKIM d= and s= values, trusted authentication results and the alignment conclusion. Keep unobserved cells explicitly empty or marked “not collected.” A preview screenshot cannot fill a message-header field.

Consider a fictional invitation from events@harbor.example. A receiver-verified signature with d=harbor.example supplies an exact aligned DKIM identity. A link pointing at mail.harbor.example proves nothing about that signature. Similarly, merely seeing a wps selector in a header does not prove that its cryptographic verification passed. These examples illustrate the decision rule only; they are not captured Webpower traffic.

After an approved change and the required provider handoff, inspect a controlled message from the selected workflow. Establish which receiver produced the authentication assessment, rather than trusting an assertion inserted by an upstream sender. RFC 8601, section 7.1 explains that trust boundary. Keep unexpected results and diagnostics with the case, and avoid extending one campaign's conclusion to every license workflow.

Preserve the unfinished evidence requirement

The exact catalogue requirement is: Current Webpower first-party setup evidence and a received-message identity table from the exact product and route.

The current product and documentary workflow are supported. The original identity table, account applicability, provider activation and authorized operational verification are not complete. Recovery planning must cover affected campaigns and any changed routing or trust, with dependencies checked before old records are retired. Independent technical review, site presentation, owner acceptance and publication approval remain open. Nothing here certifies delivery or a completed deployment.

[ Takeaway ]

Choose the correct domain branch first. Then accept only the specific campaign route supported by an authorized change and trustworthy received-message evidence.

[ By role ]

What this means for you

Choose your role for practical next steps.

Campaign administrator

Identify the license-wide impact

A change made while viewing one campaign can affect others using the same license.

Next steps

  1. List the affected brands and campaigns before requesting a domain change.
  2. Select the exact sender address and reply behavior for the acceptance workflow.
  3. Keep untested workflow variants outside the verification claim.

DNS and infrastructure owner

Protect unrelated routing

Authentication preparation should not silently replace website or inbound-mail infrastructure.

Next steps

  1. Separate main-domain DKIM work from local-domain A and MX requirements.
  2. Confirm license-specific targets and preserve current values before approval.
  3. Review SPF dependencies, reporting destinations and recovery steps as separate decisions.

Technical reviewer

Accept evidence at the protocol boundary

The decisive record connects the real application route to a trustworthy receiver observation.

Next steps

  1. Check every DKIM signing domain and selector, not just the first signature.
  2. Do not infer the SMTP envelope from a product label or branded link.
  3. Retain the exact original-evidence gate until the controlled message and owner acceptance exist.

[ FAQs ]

Frequently asked questions

Why does a Webpower guide use MailPro documentation?

Spotler explicitly identifies Webpower’s marketing automation software as continuing under the MailPro name. Confirm that the actual account follows this product route; the rebrand does not authorize importing Mail+ or SendPro settings.

Can I use the main domain as the visible sender?

The documented Sender domain branch supports that choice subject to its local-domain prerequisite, access requirements, verification and provider handoff. It is not permission to alter the organization’s main-domain routing records.

Should I copy the local-domain A and MX records to our main domain?

No. First establish which domain the procedure covers and what currently depends on it. These records affect routing beyond a signing key. A main-domain sender procedure must not be replaced with a local-domain infrastructure bundle.

Where do the two DKIM destinations come from?

The current Sender domain page provides wps1 and wps2 alias patterns containing the license name. Obtain the correct license-specific values from the intended account and instructions, then verify the actual message rather than treating publication as proof of signing.

Does the Local Domain label prove which SMTP envelope is used?

No. A product’s label and its link-hosting role do not establish an observed SMTP MAIL FROM identity. Keep that identity as a separate evidence field and assess SPF at the correct domain.

Is the provider’s 24-hour TTL an authentication guarantee?

No. It is a documented DNS setting recommendation. Acceptance still requires the relevant records, actual signing behavior and trusted receiver results; elapsed time cannot supply those observations.

Will adding p=none automatically generate DMARC reports?

No. Monitoring disposition and reporting destinations are separate settings. Review the report configuration and ownership, and do not overwrite an existing domain policy simply to match a sample.

What remains before this route can be called verified?

Collect the account-specific configuration, required provider completion and a received-message identity table for the chosen campaign. Resolve terminology and scope with a technical reviewer. This manuscript contains none of those original operational results.

[ Sources ]

Sources

  1. Spotler MailPro: Sender addresses
  2. RFC 8601: Message Header Field for Indicating Message Authentication Status
  3. RFC 6376: DomainKeys Identified Mail Signatures
  4. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance
  5. Spotler: Webpower is now Spotler
  6. Spotler MailPro: Why do I need a Local Domain?
  7. RFC 9990: DMARC Aggregate Reporting
  8. Spotler MailPro: Sender domain
  9. RFC 7208: Sender Policy Framework

[ Glossary ]

Glossary

MailPro license
The product scope within which documented Sender domain changes can affect multiple campaigns. It is not merely the campaign currently open in the interface.
Local Domain
MailPro’s organization-owned domain or subdomain supporting technical mailing elements. Its product role is distinct from evidence of an actual SMTP envelope.
Sender domain
The MailPro setting for a domain used by configured sender addresses, with a documented main-domain procedure and linked local-domain dependency.
DKIM signing domain
The domain named by d= in a DKIM signature. Successful verification and DMARC alignment must still be established.
Alignment evidence
A recorded comparison between a successfully authenticated domain and the visible From domain under the applicable DMARC alignment mode. A DNS record or logo alone does not supply it.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base