[ Sending-service guides ]

Authenticate email sent through Acquia Cloud: configuration and verification

Configure Acquia Platform Email for the actual Drupal application, then verify its sending identities rather than reusing legacy DNS.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Verify the email domain separately from the website domain.
  • Associate the verified domain with the actual Drupal application.
  • Retire the legacy SPF dependency without deleting other authorizations.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Retire the legacy SPF dependency without deleting other authorizations.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Document domain verification, application association and Drupal transport as three separate checkpoints.

Next steps

  1. Document domain verification, application association and Drupal transport as three separate checkpoints.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Review shared-domain dependencies before retirement and retain evidence of the authenticated identity used by each application.

Next steps

  1. Review shared-domain dependencies before retirement and retain evidence of the authenticated identity used by each application.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Tie release approval to a tested business notification, such as a form acknowledgement, not a green DNS badge.

Next steps

  1. Tie release approval to a tested business notification, such as a form acknowledgement, not a green DNS badge.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Does adding the website domain configure email?

No. Acquia distinguishes website Domain Management from the Platform Email domain configuration.

Acquia: Configuring Platform Email

Can I keep using the old Acquia SPF include?

Do not add it for current Platform Email. Acquia says its legacy dependency is no longer required; review existing use before removing that term.

Acquia: SPF record error for Platform Email

Who associates the verified domain?

Acquia lists the owner role for application association. Domain configuration and association have different prerequisites.

Acquia: Configuring Platform Email

Does this cover an SMTP module using another vendor?

No. Identify and authenticate that vendor route separately.

Acquia: Configuring Platform Email

Should I copy SES records from a sample?

No. Publish the records shown for your actual Platform Email domain.

Acquia: Configuring Platform Email

What message should I test?

A representative notification sent through the real Drupal application transport, to a mailbox you control.

Why can verification pass while mail is wrong?

The application can use another transport, another From domain or an association different from the one you verified.

Can I delete the domain to troubleshoot?

First inspect every application association and preserve a recovery plan. Deletion is not a substitute for diagnosing the sending route.

Acquia: Configuring Platform Email

[ Sources ]

Sources

  1. Acquia: Configuring Platform Email

    Sections Prerequisites · Configuring a domain · Associating a domain to an application · Configuring the email address for sending emails · Deleting a domain

  2. Acquia: SPF record error for Platform Email

    Sections Issue · Resolution · Cause

  3. RFC 9989: DMARC

    Sections §4.4.1 DKIM-authenticated identifiers · §4.4.2 SPF-authenticated identifiers · §4.10 DNS tree walk and duplicate policy records · §5.3.5 Determine DMARC pass or fail

  4. RFC 7208: SPF

    Sections §3.2 Multiple DNS records · §4.5 Selecting records · §4.6.4 DNS lookup limits

  5. RFC 6376: DKIM

    Sections §3.3 Signing and verification algorithms · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base