Establish the sending domain and campaign scope
Choose the approved From domain before arranging authentication. Record the WordFly account, campaign owner, DNS administrator and the exact sender addresses that upcoming campaigns will use. Include automated campaigns and test sends in the inventory. A preview message or provider-owned From address is not sufficient evidence for a campaign using the organization's domain.
WordFly's dedicated DKIM article describes dual signing with wordfly.com and the customer's sending domain, and requires publishing the supplied custom DKIM record and a DMARC record before safely sending. Its broader sending guide has less specific language about custom signing. Use the dedicated authentication workflow and verify the actual customer-domain signature rather than relying on older general phrasing. Custom DKIM, Sending guide.
Coordinate publishing with WordFly
Request the custom DKIM public record from WordFly support for the approved domain. Publish the supplied TXT record at authoritative DNS, then tell support it is ready for verification. The documentation advises allowing two to three days for setup and testing. Do not schedule a last-minute full campaign on the assumption that DNS publication alone completes provider activation. WordFly DKIM setup.
Save the support instruction, owner name, record type and complete public value with the change request. Check whether the DNS editor appends the domain suffix and whether another record occupies the proposed name. Use the current support-provided selector rather than treating a public article's example as an immutable account setting. Never publish a private signing key.
Keep SPF and DMARC decisions distinct
WordFly's sending guide says it publishes SPF for its sending domain and authenticates the return-path or bounce address. This establishes the provider's SPF role; it does not prove a customer's custom envelope domain or customer-domain SPF alignment. Do not add a guessed apex include to create a false appearance of alignment. Inspect the actual envelope domain on a test message. WordFly sending guide.
Review the organization's existing DMARC record with its owner. Retain approved policy and reporting arrangements while onboarding the campaign route. A passing customer-domain DKIM signature may provide the aligned path even when provider-owned SPF is unaligned. Match the observed d= value to the visible From using the domain's actual alignment mode. DMARC.
Inspect both signatures in a real workflow
Send a controlled campaign to authorized test recipients only after provider verification. Preserve the original message and the receiving system's authentication results. Do not stop at the first dkim=pass result: determine which signature passed and whether its domain aligns.
- Synthetic signature case: d=wordfly.com passes; Meaning: Provider signature validates; Next decision: Check the customer signature separately
- Synthetic signature case: d=example.com passes with From news@example.com; Meaning: Exact-domain alignment in this example; Next decision: Confirm receiver DMARC and retain evidence
- Synthetic signature case: Customer signature fails, provider signature passes; Meaning: Provider authentication alone is insufficient for that From; Next decision: Investigate the customer selector and signed-message integrity
These are synthetic cases, not observed WordFly deliveries. Record every d= and s= pair so a second passing signature cannot conceal a failing customer signature. Test the final campaign content path, including any link processing or forwarding route that matters to the intended audience. Inbox placement is a separate observation from authentication acceptance.
Repair before launching the campaign
If the DNS is correct but the customer signature is missing, confirm provider-side activation and the campaign's chosen From domain. If a signature fails, compare the selector lookup and preserve the receiver's failure reason. Give support a redacted original or diagnostic details appropriate for its secure support channel. Do not generate unrelated replacement keys or delete the provider signature.
Hold the affected campaign while the authentication evidence is incomplete. Keep the old selector available for queued mail when a rotation is planned, following the provider's transition instructions. After repair, repeat the original test and obtain campaign-owner acceptance before release. Archive the verified record set, support confirmation and received originals. Review dormant accounts and selectors when campaigns are retired. This draft contains no live account access, DNS changes or sent campaign evidence.
Confirm the provider boundary
The detailed guide shows wordfly02._domainkey as its public example; compare the exact current Support instruction rather than guessing or overwriting an occupied selector. It also calls for a postmaster mailbox. Keep launch checks for subscriber permission, a working unsubscribe link and a suitable warm-up plan separate from DNS validation. These are sending-guide requirements and recommendations, not proof that this campaign is compliant or delivered.
Work through a fictional diagnostic case
Fictional written case only: WFL-01 assumes From news@theatre.example, a passing d=wordfly.com signature and a failed d=theatre.example signature. The envelope and SPF result are unknown. The provider signature is unaligned, but the evidence does not establish a complete DMARC failure because SPF remains unknown. The mail owner must inspect the customer selector and failure reason with Support, then repeat the approved final-content test. Do not remove the provider signature to make the results look simpler. No account, DNS, CRM, invoice, campaign or delivery was tested for this case.
Separate a passing message from enforcement readiness
RFC 9989 Section 7.4 requires valid DKIM for a domain publishing p=reject and cautions about indirect-mail interoperability. A single aligned SPF result does not by itself justify a reject-policy rollout. Review all legitimate routes and policy ownership separately from this provider setup.