[ Sending-service guides ]

Authenticate one.com hosted email with the correct DNS and migration branch

Separate one.com hosted mail from other senders, resolve the two-versus-four DKIM record question, and verify the published records against a received message.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Confirm the migrated or non-migrated DKIM record set with support.
  • Preserve custom SPF and avoid broad DNS resets.
  • Verify mailbox and application routes separately.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify mailbox and application routes separately.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Mail admin perspective on platform-specific records

Resolve the two-versus-four DKIM discrepancy with a domain-specific support response.

Next steps

  1. Record the active DNS host and migration branch.
  2. Preserve a single valid SPF policy.
  3. Verify the selectors actually present in received mail.

CISO / SecOps

CISO perspective on controlled delegation

A published CNAME delegates signing-related trust and needs an owner.

Next steps

  1. Retain old-selector retirement decisions.
  2. Preserve approved DMARC policy and reporting.
  3. Keep live, visual and human acceptance gates open.

Founder / Non-technical

Founder perspective on keeping business mail running

Treat DNS migration and mailbox migration as distinct changes.

Next steps

  1. Name the owner of customer-critical mail.
  2. Keep website and MX changes outside this repair.
  3. Require evidence from the actual business workflow.

[ FAQs ]

Frequently asked questions

Does one.com configure DKIM automatically?

Its guidance says yes when its mail servers and nameservers are both used. External DNS requires the applicable support-issued CNAME records, and received-message verification is still needed.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Do I need two or four DKIM records?

The dedicated guide distinguishes migrated and non-migrated domains, while another guide still says four. Obtain the exact current set for your domain from support.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Where do I publish records with external nameservers?

At the DNS host serving the authoritative zone. Records saved in an inactive one.com zone do not change public DNS.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Should I enable the standard SPF toggle if a custom policy exists?

Inspect the existing policy and sender inventory first. The goal is one valid policy for the evaluated envelope owner, with all required authorized senders preserved.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Can Reset DNS records fix a single DKIM problem?

It is too broad for that purpose: the provider says it removes personal settings and restores defaults. Repair the affected record after identifying its owner.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Does a passing webmail test cover my website form?

No. The form may use a different SMTP service, envelope domain or signing identity. Test its actual workflow separately.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

Should I replace my DMARC policy with a provider example?

No. Preserve the approved domain policy unless a separately reviewed change authorizes new enforcement, alignment or report destinations.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

What remains before this is a verified implementation?

Domain-specific platform confirmation, tenant inspection, authoritative DNS evidence, independently received messages, visual checks and human SME approval remain pending.

one.com: Add an SPF record one.com: DKIM for email accounts one.com: Email with external nameservers one.com: Manage DNS settings SPF RFC 7208 DKIM RFC 6376 DMARC RFC 9989 DNS RFC 2181

[ Sources ]

Sources

  1. one.com: Add an SPF record

    Sections Standard SPF toggle39–50; custom configuration29

  2. one.com: DKIM for email accounts

    Sections Automatic48; external branch63–76, migrated2 versus nonmigrated4

  3. one.com: Email with external nameservers

    Sections External authority34; SPF61–66; conflicting four-CNAME instruction78–81

  4. one.com: Manage DNS settings

    Sections Supported types35–54; reset61; empty apex66–68

  5. SPF RFC 7208

    Sections §3.2; 3.3; 4.6.4

  6. DKIM RFC 6376

    Sections §3.5; 3.6.2; 6.1

  7. DMARC RFC 9989

    Sections §4.4; 4.7; 4.10; 5

  8. DNS RFC 2181

    Sections §10.1 CNAME resource records

[ Glossary ]

Glossary

Migration branch
The one.com mail platform applicable to a domain, which affects its documented DKIM record set.
Standard DNS setting
A provider-managed default that may interact with a custom record.
Envelope owner
The DNS name evaluated by SPF for the SMTP sender identity.
Authoritative answer
The record returned by the nameservers responsible for the active DNS zone.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base