[ Sending-service guides ]

Authenticate email sent through Keap: configuration and verification

Connect a Keap sending domain using current Thryv documentation, audit automation owners, and avoid treating legacy DMARC percentage guidance as a safety guarantee.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Use edition-specific settings and tenant-issued aliases.
  • Preserve existing policy rather than relying on legacy pct sampling.
  • Test assigned-owner and fallback-owner automations separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test assigned-owner and fallback-owner automations separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Use the account-generated aliases

Current settings and aliases must match the actual Keap edition and tenant.

Next steps

  1. Preserve existing domain policy.
  2. Resolve collisions with a supported prefix.
  3. Verify receiver identities after Connected status.

CISO / SecOps

Review the legacy percentage recommendation

The current DMARC standard removes pct, so a five-percent promise is unsafe.

Next steps

  1. Approve policy independently.
  2. Inventory every sender on the domain.
  3. Retain original message evidence.

Founder / Non-technical

Keep automations connected to approved senders

A verified domain does not ensure that every contact owner or fallback uses it.

Next steps

  1. Inventory active automations.
  2. Approve ownership changes explicitly.
  3. Test assigned and unassigned contacts.

[ FAQs ]

Frequently asked questions

Where is current Keap guidance hosted?

The cited current authentication and automation guides are in Thryv’s support center.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I reuse another tenant’s CNAME values?

No. Publish the complete values generated for this tenant and domain.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I replace an existing DMARC policy during connection?

No. Preserve it unless the domain owner separately approves a policy change.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does pct=5 guarantee a five-percent quarantine rollout?

No. RFC 9989 removes pct, so do not depend on that legacy percentage control.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why can a Contact Owner automation fail before delivery?

Keap documents a sending restriction when that owner’s domain is not authenticated and Connected.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Which fallback needs testing?

The default contact owner used for contacts without an assigned owner.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What SPF include should I copy from this guide?

None. The retrieved current setup does not establish a universal include; use current account-specific guidance and observed identities.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is Connected status the final acceptance gate?

No. Complete real workflow tests, received-message identity rows and human review.

How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. How to Authenticate Your Domain in Keap to Protect Email Deliverability – Thryv

    Sections Steps1–6; lines44–117; existing DMARC72, pct75–90, conflict93

  2. Update Email Automations for Authenticated Domain Sending in Keap Ultimate – Thryv

    Sections Authenticated contact owners; Step1 user audit; default contact owner and bulk update sections

  3. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  4. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  5. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Connected
Keap’s domain-verification state, distinct from a received-message result.
Contact Owner
A dynamic sender choice that can select the user responsible for a contact.
Default owner
The fallback user for contacts without an assigned owner.
CNAME delegation
A DNS alias that points an owner name to provider-managed data.
pct
A legacy DMARC percentage tag removed by RFC 9989.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base