[ Sending-service guides ]

Authenticate email sent through Acyba / AcyMailing: configuration and verification

Identify whether AcyMailing uses its sending service or another transport before choosing the DKIM and DNS workflow.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Identify the selected transport before choosing a signing workflow.
  • Hosted CNAME delegation and application TXT keys are different setups.
  • Retest authentication whenever the transport changes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Retest authentication whenever the transport changes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Document the chosen transport and use only its applicable authentication workflow.

Next steps

  1. Document the chosen transport and use only its applicable authentication workflow.
  2. Preserve the exact generated record set and the authoritative DNS before-and-after comparison.
  3. Capture From, SPF identity, DKIM d=/s= and trusted receiver results from the real route.

CISO / SecOps

Govern the remaining exposure

Keep private keys out of shared tickets and public DNS; review obsolete delegations when a transport is retired.

Next steps

  1. Keep private keys out of shared tickets and public DNS; review obsolete delegations when a transport is retired.
  2. Require a recorded decision for any unresolved authentication or vendor-capability exception.
  3. Review obsolete DNS authorizations and delegations when this service is retired.

Founder / Non-technical

Own the sending outcome

Treat a sending-method change as a delivery dependency change rather than a cosmetic plugin setting.

Next steps

  1. Treat a sending-method change as a delivery dependency change rather than a cosmetic plugin setting.
  2. Assign the business workflow and sending-domain owner before approving the change.
  3. Keep the affected campaign paused until its acceptance evidence is available.

[ FAQs ]

Frequently asked questions

Is AcyMailing always the delivery server?

No. Confirm whether the installation uses its sending service, the website server or another SMTP supplier.

AcyMailing: Activating the sending service

Which records apply to the sending service?

Use the CNAME entries generated for the owned domain in the service configuration.

AcyMailing: Activating the sending service

Should I enable application DKIM when SMTP already signs?

The AcyMailing DKIM guide recommends using the server or SMTP supplier signing in that case instead of its own DKIM option. Its application-signing guide lists Enterprise as a prerequisite; confirm the installed version.

AcyMailing: Set up DKIM

Do I put the private key in DNS?

No. DNS publishes the public verification material or its delegation, never the private signing key.

RFC 6376: DKIM

Why is the domain still pending?

Compare the public record names and targets with the generated entries, including accidentally appended domain suffixes.

AcyMailing: Activating the sending service

Can I validate gmail.com as my domain?

No. Use a domain you control; owning an address at a consumer provider does not confer DNS control.

AcyMailing: Activating the sending service

Does changing transport require another test?

Yes. The new transport may change the envelope and DKIM identities even if the visible sender is unchanged.

What does Update domains statuses prove?

It refreshes setup status. Retain a received-message test to prove the actual selected route authenticates and aligns.

AcyMailing: Activating the sending service

[ Sources ]

Sources

  1. AcyMailing: Activating the sending service

    Sections Configure the sending method · Troubleshooting: Entries still pending after several hours · Troubleshooting: My MAIL FROM is not aligned

  2. AcyMailing: Set up DKIM

    Sections Before starting · Generate your public and private keys · Add your DNS record · Check your DNS record

  3. RFC 9989: DMARC

    Sections §4.4.1 DKIM-authenticated identifiers · §4.4.2 SPF-authenticated identifiers · §4.10 DNS tree walk and duplicate policy records · §5.3.5 Determine DMARC pass or fail

  4. RFC 7208: SPF

    Sections §3.2 Multiple DNS records · §4.5 Selecting records · §4.6.4 DNS lookup limits

  5. RFC 6376: DKIM

    Sections §3.3 Signing and verification algorithms · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Visible From
The author address displayed in the message From header, whose domain is used for DMARC alignment.
Envelope identity
The SMTP sending identity evaluated by SPF, distinct from the visible From and Reply-To.
DKIM selector
The s= identifier used with the signing d= domain to locate the verification key.
Alignment
The required domain relationship between an authenticated SPF or DKIM identity and the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base