[ Sending-service guides ]

Authenticate email sent through Cakemail: configuration and verification

Authenticate each Cakemail sender domain with generated TXT records, then validate tracking and bounce CNAMEs as separate dependencies.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Authenticate the sender and configure tracking/bounce records separately.
  • Use the domain-generated TXT value and preserve existing DMARC protection.
  • A working tracking link does not prove message authentication.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

A working tracking link does not prove message authentication.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Copy each domain’s generated values and retain DNS plus received-message evidence.

Next steps

  1. Start with the documented DKIM variant and copied values.
  2. Inspect each tracking and bounce CNAME status plus received headers.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Review CNAME ownership and the effect of new child DMARC policies before approving changes.

Next steps

  1. Review occupied hostnames before adding aliases.
  2. Assess a child DMARC policy against inherited protection.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Make sender authentication and branded-link acceptance separate launch checks.

Next steps

  1. Set separate authentication and link-readiness criteria.
  2. Assign an owner for DNS and sender-domain maintenance.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Where do I authenticate a Cakemail domain?

Use Settings, Domains, then the intended Sender Domains entry and Authenticate Domain.

Cakemail domain authentication

Which DKIM variant should I start with?

The current guide recommends Variant 1. Ask support about another variant after verifying the published record.

Cakemail domain authentication

Can I reuse a DKIM value for another domain?

No. Use that domain’s generated record and verify its signing identity.

Cakemail domain authentication

Should I replace an existing DMARC record with none?

Not automatically. Preserve the approved policy and assess inheritance before adding or changing a record.

Cakemail domain authentication

Are tracking and bounce settings part of the same badge?

They have separate record statuses. Check both even when the sender domain is authenticated.

Cakemail tracking and bounce domains

What record types does the current workflow show?

DKIM and DMARC use TXT; the documented tracking and bounce setup uses two CNAMEs.

Cakemail tracking and bounce domains

Does a working tracking link prove SPF alignment?

No. Inspect Return-Path and trusted receiver results from a real message.

Why can authenticated mail still go to spam?

Authentication is only one receiver input. Reputation, recipient engagement, content and local filtering remain relevant.

[ Sources ]

Sources

  1. Cakemail domain authentication

    Sections Authenticate your domain · Private domains vs public domains · Troubleshooting

  2. Cakemail tracking and bounce domains

    Sections Set up tracking and bounce alignment · What each one does · Troubleshooting

  3. RFC 7208 SPF

    Sections §3.2 Multiple DNS records · §4.6.4 DNS lookup limits · §5.2 include · §5.3 a

  4. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature · §3.6.2.2 TXT record concatenation · §6 Verifier actions

  5. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail · §5.3.6 Apply policy if appropriate

  6. RFC 1034 DNS concepts

    Sections §3.6.2 Aliases and canonical names · §4.2 How the database is divided into zones

  7. RFC 2308 DNS negative caching

    Sections §5 Caching Negative Answers

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base