[ Sending-service guides ]

Authenticate email sent through Apsis: configuration and verification

Apsis One documents provider-managed envelope SPF and customer-domain DKIM activated by its Delivery team. Publish the supplied TXT key, complete activation and verify alignment before a campaign or DMARC policy change.

By the EmailAuth research team · 6 min read

[ Key points ]

  • The documented Apsis One envelope uses provider-managed SPF.
  • Customer-domain DKIM must be published and separately activated.
  • Preserve a long public key as one TXT record with its complete value.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Preserve a long public key as one TXT record with its complete value.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Own records and route evidence

Documentary setup is not a substitute for an aligned received-message result.

Next steps

  1. Retain the provider record set and before-change DNS export.
  2. Complete provider activation and verify every intended route.
  3. Record the raw message, trusted results and rollback owner.

CISO / SecOps

Approve scoped trust and residual risk

Provider signing authority and domain policy affect more than one campaign.

Next steps

  1. Review selector ownership and shared-service dependencies.
  2. Keep domain-wide enforcement separate from this integration change.
  3. Require human review and live evidence before publication or production sign-off.

Founder / Non-technical

Protect the Apsis One business workflow

Sender changes can disrupt customer recognition and replies even when authentication passes.

Next steps

  1. Identify the exact messages customers need.
  2. Approve the intended From and fallback identities.
  3. Release only after operations reviews a controlled message.

[ FAQs ]

Frequently asked questions

Do I add Apsis One to my own SPF record?

Not for the documented default route. Apsis says its technical sender is apsisone.com and SPF is managed in its DNS. Confirm scope before applying this to another product or custom route.

Apsis One email authentication and safe sending

Why can Apsis One pass SPF while my DMARC fails?

The documented apsisone.com technical identity does not align with an unrelated customer From domain. Customer-domain DKIM must provide the aligned path for that route.

Apsis One email authentication and safe sending

Who chooses the DKIM selector?

The setup article asks you to provide a selector to Apsis. Coordinate a unique, unused value with the DNS administrator and Delivery team.

Apsis One email authentication and safe sending

Does publishing the public key turn signing on?

No. Tell Apsis the key is published; its Delivery team then activates DKIM signing on the MTA.

Apsis One email authentication and safe sending

How should I split a long DKIM TXT value?

Use multiple character strings within the same TXT resource record when required by the DNS interface, preserving the whole value. Do not create separate competing keys or truncate the public key.

Apsis One email authentication and safe sending

Can one domain setup cover all our brands?

The Apsis article calls for a separate DKIM key for every sending domain. Test each actual From domain rather than assuming another brand is covered.

Apsis One email authentication and safe sending

Should I change DMARC as soon as DKIM lookup succeeds?

No. Confirm activation and a passing aligned message, then inventory other legitimate senders before changing the domain-wide policy.

Does DKIM encrypt campaign content?

No. It provides a verifiable signature tied to a signing domain. Confidentiality in transit or message-content encryption is a separate concern.

[ Sources ]

Sources

  1. Apsis One email authentication and safe sending

    Sections SPF (Sender Policy Framework) · What Apsis needs from you · The setup process · Understanding DKIM key pairs and DNS publishing · How to verify DKIM is working

  2. RFC 7208

    Sections §3.2 Multiple DNS records · §4.6.4 DNS lookup limits · §5.2 include · §5.3 a

  3. RFC 6376

    Sections §3.5 DKIM-Signature · §3.6.2.2 TXT record concatenation · §6 Verifier actions

  4. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail · §5.3.6 Apply policy if appropriate

  5. RFC 1035: DNS implementation and specification

    Sections §3.3 Standard RRs: character-string encoding · §3.3.14 TXT RDATA format

[ Glossary ]

Glossary

Envelope identity
The SMTP sender identity evaluated by SPF, distinct from the visible From address.
DKIM selector
The s= identifier used with the signing d= domain to locate a public verification key.
Alignment
The domain relationship required between an authenticated identity and the visible From domain for DMARC.
CNAME
A DNS alias record; publish only the provider-supplied name and target for the intended service.
TXT record
A DNS resource record used for SPF, DKIM public keys and DMARC policies; multiple strings can form one value.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base