[ Sending-service guides ]

Authenticate email sent through Apptivo: configuration and verification

Apptivo's Amazon SES migration makes account-specific support records the starting point. Separate domain verification, free-address verification and mailbox synchronization before changing DNS.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Separate the SES migration workflow from legacy generated-record instructions.
  • Use only the current support-issued records for the affected account.
  • Domain authentication and mailbox synchronization are different checks.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Domain authentication and mailbox synchronization are different checks.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Own records and route evidence

Documentary setup is not a substitute for an aligned received-message result.

Next steps

  1. Retain the provider record set and before-change DNS export.
  2. Complete provider activation and verify every intended route.
  3. Record the raw message, trusted results and rollback owner.

CISO / SecOps

Approve scoped trust and residual risk

Provider signing authority and domain policy affect more than one campaign.

Next steps

  1. Review selector ownership and shared-service dependencies.
  2. Keep domain-wide enforcement separate from this integration change.
  3. Require human review and live evidence before publication or production sign-off.

Founder / Non-technical

Protect the Apptivo business workflow

Sender changes can disrupt customer recognition and replies even when authentication passes.

Next steps

  1. Identify the exact messages customers need.
  2. Approve the intended From and fallback identities.
  3. Release only after operations reviews a controlled message.

[ FAQs ]

Frequently asked questions

Why do the older Apptivo instructions look different?

The 2020 manual describes generated SPF/DKIM records in Business Settings; the 2024 SES migration directs users to Support. Confirm the workflow for your account rather than combining both.

Apptivo legacy DKIM and SPF records

Should I always create six CNAME records?

The SES migration article describes six. Publish only the current records supplied for your account and resolve any discrepancy with Support.

Apptivo SES migration and domain verification

What SPF value should I copy?

Use the updated IP information supplied by Apptivo for the applicable domain and route. The retained migration article provides no universal value to substitute.

Apptivo SES migration and domain verification

Can I authenticate a Gmail address with my own DNS?

No. Apptivo documents an address-verification link for free accounts. You do not control Gmail DNS; verify the actual resulting sending identity separately.

Apptivo SES migration and domain verification

Does domain verification repair mailbox sync?

Not necessarily. The migration article treats sync reauthentication as a separate step when sending or receiving problems remain.

Apptivo SES migration and domain verification

Does Amazon SES automatically prove aligned DKIM?

No. Collect the actual signature d=, s= and receiver result from the Apptivo workflow. A verified domain or provider branding alone is insufficient.

What evidence should I give Support if setup fails?

Provide the account and workflow, domain, supplied record names, authoritative DNS results, time of change and a redacted test-message authentication result. Never send mailbox passwords or private signing keys.

When is this Apptivo setup ready for release?

After Support confirms the relevant verification/activation and a controlled message on each required route has a passing aligned identity. Human review and live evidence remain pending for this draft.

[ Sources ]

Sources

  1. Apptivo SES migration and domain verification

    Sections Users with paid domains · Users with Free Email Accounts · Re-authentication of Email Sync · Last modified March 13, 2024

  2. Apptivo legacy DKIM and SPF records

    Sections DKIM & SPF Records steps 1–6 · Last modified November 3, 2020

  3. RFC 7208

    Sections §3.2 Multiple DNS records · §4.6.4 DNS lookup limits · §5.2 include · §5.3 a

  4. RFC 6376

    Sections §3.5 DKIM-Signature · §3.6.2.2 TXT record concatenation · §6 Verifier actions

  5. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail · §5.3.6 Apply policy if appropriate

[ Glossary ]

Glossary

Envelope identity
The SMTP sender identity evaluated by SPF, distinct from the visible From address.
DKIM selector
The s= identifier used with the signing d= domain to locate a public verification key.
Alignment
The domain relationship required between an authenticated identity and the visible From domain for DMARC.
CNAME
A DNS alias record; publish only the provider-supplied name and target for the intended service.
TXT record
A DNS resource record used for SPF, DKIM public keys and DMARC policies; multiple strings can form one value.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base