[ Sending-service guides ]

Authenticate Nutshell Email Marketing without confusing connected mailbox routes

Verify marketing sender addresses, apply tenant-generated records and test campaign alignment separately from connected email and shared-inbox replies.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Distinguish Email Marketing from connected mailboxes and shared inboxes.
  • Use current tenant values rather than replaying the 2022 migration.
  • Preserve corporate inbox MX while configuring bounce routing.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Preserve corporate inbox MX while configuring bounce routing.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Use the current tenant record set

Legacy migration instructions and tracking records are not substitutes for current signing evidence.

Next steps

  1. Verify the sender and obtain its Domains records.
  2. Preserve bounce routing and existing mailbox MX records.
  3. Check a fresh campaign’s identities and alignment.

CISO / SecOps

Keep authentication changes narrowly scoped

Automated DNS access and record retirement need deliberate review.

Next steps

  1. Review permissions before connecting a DNS automation service.
  2. Retire legacy records only after dependency checks.
  3. Require evidence and human approval for each sending route.

Founder / Non-technical

Protect campaigns and sales replies separately

Nutshell features can send through different authentication paths.

Next steps

  1. Name the marketing route covered by the change.
  2. Keep mailbox and shared-inbox tests separate.
  3. Approve sender identity and rollout timing.

[ FAQs ]

Frequently asked questions

Which Nutshell route does this implementation cover?

Email Marketing. Connected Google, Microsoft or SMTP accounts and CRM Sales inbox replies require separate route evidence.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Where do I obtain the DNS values?

Verify the marketing sender address and inspect the tenant’s Domains configuration. Obtain support confirmation for any customization or activation the account requires.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Does a custom tracking domain establish DKIM alignment?

No. Tracking URLs, bounce routing and DKIM signing identities serve different purposes and must be checked separately.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Should I replace our main MX records?

No such change is justified by this guide. Use only the exact bounce-subdomain MX instructions supplied for the tenant and preserve unrelated mailbox routing.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Does every account need the April 2022 DNS update?

No. The retained article describes a historical migration for affected accounts. Apply it only if the current tenant notice and provider instructions establish its relevance.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Why can Nutshell verification fail after I added the record?

Check the exact name, type and value, including whether the editor appended the domain twice. Then compare authoritative DNS and tenant assignment.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Can DMARC pass when the envelope domain is unaligned?

Yes. A passing DKIM signature aligned with the visible From domain can provide the required aligned path.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Is this a verified production setup?

No. Current tenant inspection, authoritative DNS and received-message tests, visual review and human approval are pending.

Nutshell Email Marketing authentication Nutshell Marketing custom domains Nutshell Email Marketing legacy DNS update Nutshell connected email sending Nutshell CRM Sales inbox RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

[ Sources ]

Sources

  1. Nutshell Email Marketing authentication

    Sections Sender verification23–24; personalization25–32; DMARC33–38

  2. Nutshell Marketing custom domains

    Sections Setup34–49; DNS suffix conflicts63 onward

  3. Nutshell Email Marketing legacy DNS update

    Sections April2022 migration; affected sender banner; verify before retiring old records

  4. Nutshell connected email sending

    Sections Send; Connect Google/Office365; other provider SMTP

  5. Nutshell CRM Sales inbox

    Sections Shared inbox setup; outgoing domain verification versus forwarding

  6. RFC 7208 Sender Policy Framework

    Sections §3.2; 3.3; 4.6.4

  7. RFC 6376 DomainKeys Identified Mail

    Sections §3.5; 3.6.2; 6.1

  8. RFC 9989 Domain based Message Authentication Reporting and Conformance

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Bounce domain
The domain used in the SMTP envelope return address for delivery failures.
Tracking domain
A hostname used for tracked links or hosted content, independent of the DKIM signing identity.
Legacy migration
A transition from an older delivery configuration that must be confirmed for the actual account.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base