[ Sending-service guides ]

Authenticate OneTrust notifications through the selected email account

Choose the correct OneTrust delivery method, configure its issued domain records, and verify account selection as well as SPF, DKIM and DMARC.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Founder perspective on notification continuity
  • Mail admin perspective on account selection
  • CISO perspective on controlled identity and data
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Choose the correct OneTrust delivery method, configure its issued domain records, and verify account selection as well as SPF, DKIM and DMARC.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Mail admin perspective on account selection

Verify which account sent the message before investigating its DNS.

Next steps

  1. Capture tenant-issued records rather than guessed values.
  2. Test a rule match and fallback separately.
  3. Preserve queued messages during SMTP troubleshooting.

CISO / SecOps

CISO perspective on controlled identity and data

Authentication checks should not expose real privacy-case content or credentials.

Next steps

  1. Use synthetic test content and approved recipients.
  2. Retain policy and reporting approval.
  3. Review relay permissions and domain changes independently.

Founder / Non-technical

Founder perspective on notification continuity

An email-account change can affect several teams through routing and defaults.

Next steps

  1. Identify customer-critical and regulatory workflows.
  2. Approve the intended sender identity and fallback behavior.
  3. Require synthetic workflow tests before rollout.

[ FAQs ]

Frequently asked questions

Which OneTrust delivery method should I configure?

Identify the method already selected and the intended workflow first. Default cloud delivery, Send on Behalf, custom SMTP and Exchange Online have different responsibilities and tenant entitlements.

OneTrust: Configuring Email Server Settings

Where do current Send on Behalf DNS values come from?

The documented account-creation flow exposes the configuration’s records in its Cnames section. Use that tenant-issued set and confirm any ambiguity with support.

OneTrust: Configuring Send on Behalf of my Domain

Does Verified mean every notification uses that account?

No. Rule selection and the fallback default determine which account sends a notification. Test the intended routing as well as domain verification.

OneTrust: Configuring Email Server Settings

Must I replace an existing DMARC record?

No. OneTrust’s guide says its displayed DMARC record is optional when a policy is already set. Preserve the approved policy unless a separate change is authorized.

OneTrust: Configuring Send on Behalf of my Domain DMARC RFC 9989

Does a successful SMTP connection prove DMARC passes?

No. It shows a connection-stage outcome. Inspect a message received independently to establish the final envelope, signing identities and alignment.

DMARC RFC 9989

Should I delete a failing custom SMTP configuration?

Not as an initial fix. OneTrust warns deletion can remove queued emails. Troubleshoot first and approve a queue-preservation and recovery plan before replacement.

OneTrust: Custom Email Server Configuration FAQ

Can I change the authentication domain as a simple rename?

The current Send on Behalf guide requires a new configuration for a changed domain. Review routing, defaults and pending messages as part of that migration.

OneTrust: Configuring Send on Behalf of my Domain

What evidence is still pending?

The exact tenant entitlement, issued records, current UI walkthrough, live DNS, independently received notifications, visual review and human SME approval have not been obtained.

[ Sources ]

Sources

  1. OneTrust: Configuring Email Server Settings

    Sections Email server setup options

  2. OneTrust: Configuring Send on Behalf of my Domain

    Sections Send on Behalf of my Domain

  3. OneTrust: Custom Email Server Configuration FAQ

    Sections Custom SMTP troubleshooting · Deletion and queued messages

  4. SPF RFC 7208

    Sections §3.2 Multiple DNS Records · §3.3 Multiple Strings · §4.6.4 DNS Lookup Limits

  5. DKIM RFC 6376

    Sections §3.5 DKIM-Signature Header Field · §3.6 Key Management

  6. DMARC RFC 9989

    Sections Identifier Alignment · DMARC Policy Discovery

[ Glossary ]

Glossary

Email account route
The OneTrust account and delivery method selected for a notification.
Fallback default
The email account used when no configured selection rule matches.
Send on Behalf
The OneTrust delivery method that authenticates an approved organizational sending domain.
Connection-stage test
A transport check that does not establish the recipient’s final authentication result.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base