[ Sending-service guides ]

Authenticate email sent through Kayako: configuration and verification

Configure Kayako support-email authentication without overwriting shared selectors, then verify the exact reply route and its DMARC alignment.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Confirm hosted Kayako scope rather than applying these steps to Kayako Classic.
  • Preserve existing s1/s2 selectors and request supported manual authentication if they collide.
  • Test inbound ticket creation separately from authenticated agent replies and automations.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test inbound ticket creation separately from authenticated agent replies and automations.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Resolve selector collisions first

Shared CNAME owners can already support another sending service.

Next steps

  1. Inventory existing owners.
  2. Use the provider-supported conflict route.
  3. Compare published DNS with received signatures.

CISO / SecOps

Keep domain trust scoped

A help-desk rollout should not remove another sender or weaken shared enforcement.

Next steps

  1. Review delegated selectors.
  2. Approve policy changes separately.
  3. Retain restricted message evidence.

Founder / Non-technical

Protect support continuity

Incoming ticket forwarding and authenticated replies are separate acceptance requirements.

Next steps

  1. Name the support owner.
  2. Retain the working channel.
  3. Approve each brand after a complete conversation test.

[ FAQs ]

Frequently asked questions

Does this cover Kayako Classic?

No. It covers the hosted email-channel documentation cited here; confirm a Classic installation separately.

Ensuring Your Emails Are Received and Do Not Go Into Your Customer's Spam Folder - Kayako Support Using External Domains or Email Addresses to Work With Kayako - Kayako Support

Does incoming forwarding prove outbound authentication?

No. Ticket receipt and authenticated agent replies require separate checks.

Using External Domains or Email Addresses to Work With Kayako - Kayako Support Managing the Support Email Addresses Settings - Kayako Support

What if s1 or s2 already belongs to another service?

Preserve it and request Kayako’s supported manual authentication arrangement.

Ensuring Your Emails Are Received and Do Not Go Into Your Customer's Spam Folder - Kayako Support

Can I copy a complete SPF example over my existing policy?

No. Review the applicable record and preserve other legitimate senders.

Ensuring Your Emails Are Received and Do Not Go Into Your Customer's Spam Folder - Kayako Support RFC 7208 SPF

Does the agent’s display name control DMARC alignment?

No. Inspect the actual From domain, envelope domain and DKIM signing domain.

Managing the Support Email Addresses Settings - Kayako Support RFC 9989 DMARC

Does this establish a custom Return-Path setting?

No. That capability remains unverified for the tenant.

Why test an automation as well as an agent reply?

Different workflows or sender selections may use different identities; one row cannot prove every route.

Managing the Support Email Addresses Settings - Kayako Support

What evidence is still missing?

Tenant confirmation, live DNS answers, original received-message identity rows and human SME approval.

[ Sources ]

Sources

  1. Ensuring Your Emails Are Received and Do Not Go Into Your Customer's Spam Folder - Kayako Support

    Sections Prerequisites · Adding SPF Protection · Enabling DKIM Authentication

  2. Using External Domains or Email Addresses to Work With Kayako - Kayako Support

    Sections Overview · Prerequisites · Testing

  3. Managing the Support Email Addresses Settings - Kayako Support

    Sections Solution

  4. RFC 7208 SPF

    Sections §3.2 · §3.3 · §4.6.4

  5. RFC 6376 DKIM

    Sections §3.5 · §3.6.2 · §6.1

  6. RFC 9989 DMARC

    Sections §4.4 · §4.7 · §4.10 · §5

[ Glossary ]

Glossary

Email channel
A Kayako support address and its associated conversation settings.
Selector collision
Two integrations attempting to use the same DKIM DNS owner.
Envelope identity
The SMTP identity evaluated by SPF and commonly reflected in Return-Path.
Agent display name
The human-readable sender name, distinct from the address domain.
Aligned signature
A passing DKIM signature whose signing domain has the required relationship to the visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base