[ Sending-service guides ]

Authenticate Salsa Engage email blasts series and autoresponders

Use the documented Engage custom-DKIM workflow, distinguish Pending from active signing, and verify each supporter-message route.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Define the supporter-message scope
  • Publish and activate custom DKIM
  • Review standards and policy separately
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Use the documented Engage custom-DKIM workflow, distinguish Pending from active signing, and verify each supporter-message route.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Publish and activate custom DKIM

Recognized DNS and active message signing are different acceptance points.

Next steps

  1. Use the generated TXT record.
  2. Check the Pending state and activation.
  3. Test every released sender domain.

CISO / SecOps

Review standards and policy separately

Older explanatory examples must not override current protocol rules.

Next steps

  1. Check alignment on original messages.
  2. Review SPF lookup limits and policy discovery.
  3. Keep non-Engage and live-validation holds explicit.

Founder / Non-technical

Define the supporter-message scope

Different Engage message types can use different sender domains.

Next steps

  1. Confirm the product is Engage.
  2. Approve safe tests for blasts and automations.
  3. Assign reply and campaign owners.

[ FAQs ]

Frequently asked questions

Does this guide cover Salsa Classic?

No. The verified procedure is for Salsa Engage; obtain product-specific guidance for Classic or another route.

Salsa Technical Updates On Your Domain to Help Email Deliverability

Which SPF include does the first-party Engage article document?

It documents include:salsalabs.org. Confirm the actual route and merge only the required authorization.

Salsa Technical Updates On Your Domain to Help Email Deliverability

Where is custom DKIM configured?

The documented route is Settings, then Switch to, then DKIM. Verify the current tenant interface before implementation.

Salsa Technical Updates On Your Domain to Help Email Deliverability

Can I reuse the selector in Salsa’s screenshot?

No. Use the record generated for the actual account and domain.

Salsa Technical Updates On Your Domain to Help Email Deliverability

Does Pending mean mail is already signed?

Do not assume so. The source describes recognition before server-side activation; confirm with a newly received message.

Salsa Technical Updates On Your Domain to Help Email Deliverability

Is SPF limited to ten include statements?

That is an oversimplification. RFC 7208 limits lookup-causing evaluation and nested lookups also matter.

RFC 7208 Sender Policy Framework

Does a green DKIM result always mean DMARC passes?

No. A passing authentication domain must also align with the visible From domain under the effective policy.

RFC 9989 Domain-based Message Authentication Reporting and Conformance

Can one blast test validate all autoresponders?

No. Test the actual identities and routes being released, and leave untested ones pending.

[ Sources ]

Sources

  1. Salsa Technical Updates On Your Domain to Help Email Deliverability

    Sections Configure a Custom DKIM Signature · SPF

  2. Salsa Configure DMARC for emails from Engage

    Sections Configure DMARC for emails from Engage

  3. RFC 7208 Sender Policy Framework

    Sections §4.5 Selecting Records · §4.6.4 DNS Lookup Limits

  4. RFC 6376 DomainKeys Identified Mail

    Sections §3.5 The DKIM-Signature Header Field · §6.1 Extract Signatures from the Message

  5. RFC 9989 Domain-based Message Authentication Reporting and Conformance

    Sections Identifier Alignment · DMARC Policy Discovery

[ Glossary ]

Glossary

Engage
The Salsa product covered by the retrieved configuration procedure.
Pending
A documented intermediate DKIM state that is not treated here as proof of active signing.
Autoresponder
An automated response whose sender and trigger need their own test scope.
TXT record
A DNS record type used for the documented custom DKIM public value.
Effective policy
The DMARC policy discovered for the message’s visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base