[ Sending-service guides ]

Authenticate email sent through 20i: configuration and verification

Enable 20i mailbox signing with DomainKeys, account for Stackmail SPF, and verify the actual mailbox route before changing DMARC.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Activation starts signing, while DNS enables verification.
  • Merge Stackmail permissions with the approved sender inventory.
  • Test actual mailbox coverage and independent website routes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test actual mailbox coverage and independent website routes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Retain the selected package, domain, selector and message evidence together.

Next steps

  1. Record package, domain and selected DomainKeys selector.
  2. Test both the expected mailbox coverage and any differently routed application.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Review the scope of signing authority and ensure abandoned selectors are retired through a controlled change.

Next steps

  1. Review mailbox-specific signature restrictions.
  2. Schedule retirement of obsolete keys only after active traffic is accounted for.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Treat mailbox authentication and website email as separate acceptance tasks.

Next steps

  1. Separate mailbox acceptance from website-mail acceptance.
  2. Keep a responsible owner for external DNS publication.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Which 20i area enables signing?

Manage Hosting, the intended package, then DomainKeys. Select the correct domain before adding a signature.

20i DKIM setup

Is the selector a fixed value?

20i lets you choose it. Use an unused label and retain it with the generated DNS record.

20i DKIM setup

Will 20i always publish the DNS key?

The documented automatic publication applies when its nameservers serve the domain. External DNS needs the generated record at that authority.

20i DKIM setup

Does Stackmail SPF cover my other marketing service?

No. Inventory every sender using the evaluated envelope domain and maintain one complete SPF policy.

20i SPF setup

Why can the signature fail immediately after activation?

Signing may start before cached DNS reflects the public key. Confirm authority first, then caches and the exact key.

20i DKIM setup

Should I enable every advanced option?

No. Change only controls whose effects and mailbox coverage you can test.

20i DKIM setup

Can a 20i-hosted website still be unsigned?

Yes. Its mail may leave through a different application or SMTP route from the hosted mailbox.

Is a DKIM pass an inbox guarantee?

No. It validates a signature; reputation, content and receiver policy still affect delivery.

[ Sources ]

Sources

  1. 20i DKIM setup

    Sections How to add a DKIM record at 20i · Advanced Options

  2. 20i SPF setup

    Sections How to add SPF records automatically · How to add SPF records manually

  3. RFC 7208 SPF

    Sections §3.2 Multiple DNS Records · §4.6.4 DNS Lookup Limits

  4. RFC 6376 DKIM

    Sections §3.5 The DKIM-Signature Header Field · §3.6 Key Management and Representation · §6 Verifier Actions

  5. RFC 9989 DMARC

    Sections §4.4 Identifier Alignment Explained · §5.3 Mail Receiver Actions

  6. RFC 2308 DNS negative caching

    Sections §5 Caching Negative Answers

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base