[ Sending-service guides ]
Authenticate email sent through Hushmail: configuration and verification
Publish Hushmail’s custom-domain authentication without confusing mailbox migration, encryption and DMARC alignment.
By the EmailAuth research team · 4 min read
[ Key points ]
- Protect correspondence continuity
- Publish the correct CNAME
- Separate security properties
[ Takeaway ]
Publish Hushmail’s custom-domain authentication without confusing mailbox migration, encryption and DMARC alignment.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Publish the correct CNAME
The selector delegates key lookup to Hushmail.
Next steps
- Check the authoritative zone.
- Preserve other selectors.
- Verify the actual signing domain.
CISO / SecOps
Separate security properties
A signature is not proof of confidentiality or compliance.
Next steps
- Use synthetic test content.
- Review DMARC enforcement.
- Document each notification route.
Founder / Non-technical
Protect correspondence continuity
Authentication repair and inbox migration have different operational risks.
Next steps
- Agree the scope before changing MX.
- Use controlled recipients.
- Keep a fallback contact route.
[ FAQs ]
Frequently asked questions
Does this guide apply to a hushmail.com address?
Its scope is an organization’s own domain connected to Hushmail, where the organization controls DNS.
What record type belongs at hush._domainkey?
Hushmail documents a CNAME pointing to _dkim.hushmail.com.
Use Hushmail with your domain Setting DKIM and DMARC for your domain
Must I authorize Mailgun as well?
Only if it is separately an approved sender. The combined example illustrates merging SPF authorizations.
Should I replace MX while repairing DKIM?
No, unless moving incoming mail is also an approved part of the work.
Should I copy Hushmail’s quarantine example over our DMARC record?
Not without reviewing the existing policy and all legitimate senders with the domain owner.
Does a passing signature prove encrypted delivery?
No. Authentication and confidentiality must be assessed separately.
Why test secure-message notifications separately?
They are distinct messages whose actual From, envelope and signing identities should be recorded rather than assumed.
What should a privacy-safe test contain?
Synthetic content sent only to controlled recipients, with no real patient, client or confidential information.
[ Sources ]
Sources
- Use Hushmail with your domain
Sections SPF record · DKIM record · DMARC record
- Setting DKIM and DMARC for your domain
Sections Add a CNAME record for DKIM · Add a TXT record for DMARC
- RFC 7208 SPF
Sections §4.6.4 · §3.2
- RFC 6376 DKIM
Sections §3.5 · §6
- RFC 9989 DMARC
Sections Identifier Alignment
[ Glossary ]
Glossary
- SPF
- DNS authorization for the SMTP envelope-sender domain, subject to a ten-lookup evaluation limit.
- DKIM selector
- The label identifying the DNS public key used to verify a message signature.
- DMARC alignment
- The relationship between the visible From domain and a passing SPF or DKIM authentication domain.
- Authoritative DNS
- The delegated service publishing the domain’s live DNS answers.
- Return-Path
- The recorded reverse-path used for delivery failure handling, distinct from the visible From address.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption