[ Sending-service guides ]

Authenticate email sent through eTrigue: configuration and verification

Authenticate eTrigue DemandCenter campaigns with current SPF authorization, support-provided DKIM configuration, and received-message verification.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Treat DemandCenter campaigns as a separate mail route.
  • Obtain account-specific DKIM and activation instructions.
  • An IP permission and a signing key prove different things.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

An IP permission and a signing key prove different things.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Treat DKIM as a coordinated change

Publishing the record and activating signing are separate responsibilities.

Next steps

  1. Obtain current account instructions.
  2. Compare selectors and identities in received headers.
  3. Coordinate signing activation with Customer Success.

CISO / SecOps

Keep a record of delegated trust

The service can authenticate mail using a domain your organization owns.

Next steps

  1. Define key-rotation and retirement owners.
  2. Require evidence before expanding or withdrawing authorization.
  3. Do not equate a public key with an IP permission.

Founder / Non-technical

Make the campaign test explicit

The next mass send should not be the first authentication test.

Next steps

  1. Assign the campaign owner.
  2. Approve a controlled pre-launch message test.
  3. Pause an unverified campaign rather than use it as a test.

[ FAQs ]

Frequently asked questions

Is my ordinary mailbox test enough?

No. Test a campaign through the actual DemandCenter account and sending domain.

Which SPF authorization does the guide document?

It documents include:etrgmail.com. Verify current account requirements and integrate it into one valid SPF policy.

eTrigue SPF and DKIM configuration

Should I add a second SPF record?

No. Reconcile authorized services into a single policy at that owner name.

eTrigue SPF and DKIM configuration

Where do I get the DKIM key?

Request the account-specific setup from eTrigue Customer Success. A generic selector does not supply the required key or activation.

eTrigue SPF and DKIM configuration

Does the etrigue selector prove signing is enabled?

No. Compare the provider instructions with a real message’s selector and confirm a valid signature at the receiver.

eTrigue SPF and DKIM configuration

Is DKIM an IP allowlist?

No. DKIM verifies a signing-domain signature over selected message content. SPF handles sending-host authorization for its evaluated identity.

Why can SPF pass without satisfying DMARC?

The authenticated envelope domain may not align with the visible From. Inspect DKIM and the applicable alignment modes.

What should I retain after setup?

The DNS change, provider instructions, activation evidence, received-message identities, campaign route and recovery owner.

[ Sources ]

Sources

  1. eTrigue SPF and DKIM configuration

    Sections Configuring SPF · Configuring DKIM · Verifying SPF and DKIM · Frequently Asked Questions: one SPF policy

  2. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  3. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  4. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
Authorization of the connecting sender for an SMTP envelope domain, subject to protocol evaluation limits.
DKIM
A signature that authenticates a signing domain and protects selected message content.
DMARC alignment
The relationship required between the visible From domain and an authenticated SPF or DKIM domain.
Selector
The DKIM identifier used with the signing domain to locate the public key.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base