[ Sending-service guides ]

Authenticate email sent through KnowBe4: configuration and verification

Configure KnowBe4 authentication for the specific training, simulated-phishing or PhishER route, keeping domain authorization separate from delivery exceptions.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Keep the exercise authorized
  • Treat each control independently
  • Do not confuse exceptions with trust
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Configure KnowBe4 authentication for the specific training, simulated-phishing or PhishER route, keeping domain authorization separate from delivery exceptions.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Treat each control independently

Phishing, training and PhishER have distinct DKIM settings and may use different envelope choices.

Next steps

  1. Publish tenant-generated selector TXT values.
  2. Validate each selected signing domain.
  3. Record special delivery routes in the evidence.

CISO / SecOps

Do not confuse exceptions with trust

An inbox delivery exception can conceal an authentication problem.

Next steps

  1. Review security bypasses separately.
  2. Keep allowlisting narrow and documented.
  3. Require receiver evidence before accepting alignment.

Founder / Non-technical

Keep the exercise authorized

A simulation change needs a bounded audience and business owner, not simply a delivery target.

Next steps

  1. Approve the sender and exercise scope.
  2. Separate training from incident-response notifications.
  3. Require results for each changed workflow.

[ FAQs ]

Frequently asked questions

Are training and phishing messages signed by default?

KnowBe4 documents default DKIM for training messages; phishing DKIM must first be enabled. Customer-domain signing requires the relevant custom configuration.

Enable and Customize DKIM Signatures

Does domain verification configure DKIM?

No. The ownership TXT record and generated DKIM selector TXT record serve different purposes.

Add a TXT Record to Your DNS Records

Where do I obtain the selector and public key?

Generate them for the allowed domain in the applicable tenant control and copy the displayed hostname and TXT value.

Enable and Customize DKIM Signatures

Does a training DKIM change cover PhishER?

Do not assume it does. PhishER has its own Email Server DKIM setup and needs its own received-message evidence.

Enable and Customize PhishER DKIM Signatures

When should the KnowBe4 SPF mechanism be considered?

Follow the provider-supported envelope setup for an approved sender domain. The SPF guide requires the Return-Path overwrite option before adding its mechanism.

Add KnowBe4 to Your Sender Policy Framework (SPF) Record Change the Return-Path Header in Your Account Settings

Is a delivered simulation proof of DMARC success?

No. Security exceptions or special delivery routes can affect treatment. Inspect trusted receiver results and identify the actual aligned path.

RFC 9989 DMARC

Should a failed test trigger blanket allowlisting?

No. Diagnose DNS, signatures, envelope identity and the intended security workflow separately with the mail-security owner.

What evidence is missing from this guide?

Current tenant output, live DNS answers and original received-message identity tables for the exact training, simulation or PhishER routes remain pending.

[ Sources ]

Sources

  1. Enable and Customize DKIM Signatures

    Sections Enabling DKIM Signatures for Phishing Emails · Using Custom DKIM Signatures in KnowBe4 Phishing Emails · Using Custom DKIM Signatures in KnowBe4 Training Emails

  2. Add a TXT Record to Your DNS Records

    Sections Before You Begin · Adding a TXT Record

  3. Enable and Customize PhishER DKIM Signatures

    Sections Enabling DKIM Signatures in PhishER · Using Custom DKIM Signatures

  4. Add KnowBe4 to Your Sender Policy Framework (SPF) Record

    Sections Add KnowBe4 to Your Sender Policy Framework (SPF) Record · Add KnowBe4’s IP Addresses to Your SPF Record

  5. Change the Return-Path Header in Your Account Settings

    Sections Overwriting the Return-Path Header on Your Phishing Tests · Changing the Return-Path Header on Your Training Emails

  6. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  7. RFC 6376 DKIM

    Sections §3.5 · §6

  8. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Allowed domain
A domain authorized and verified in the KnowBe4 account for supported uses such as custom signing.
DKIM selector
The s= identifier used with a signing domain to locate its public key.
Return-Path overwrite
A KnowBe4 setting that replaces its fixed Return-Path with the sender address for the selected workflow.
PhishER
The separate KnowBe4 workflow with its own Email Server configuration for notification signing.
Delivery exception
A receiving-system rule that changes message handling and does not itself demonstrate SPF, DKIM or DMARC success.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base