[ Sending-service guides ]

Authenticate email sent through KashFlow: configuration and verification

Distinguish KashFlow’s sending service from its SMTP override before changing SPF or making claims about DKIM support.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Identify whether KashFlow uses its native route or the SMTP override before changing DNS.
  • For the native route, current IRIS guidance specifies include:spf.kashflow.com within the existing SPF policy.
  • A successful invoice send or SMTP connection does not establish aligned authentication.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

A successful invoice send or SMTP connection does not establish aligned authentication.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Authenticate the selected transport

Mail admin: Default KashFlow delivery and SMTP override need different checks.

Next steps

  1. Confirm the active route.
  2. Apply the appropriate provider records.
  3. Capture real-message identities and results.

CISO / SecOps

Control access and evidence

CISO: SMTP credentials and OAuth grants introduce continuing access to mail services.

Next steps

  1. Approve the intended mail-service connection.
  2. Protect secrets and customer financial documents.
  3. Keep unsupported capability claims out of sign-off.

Founder / Non-technical

Protect invoice continuity

Founder: A mail change should not delay collections or create duplicate customer messages.

Next steps

  1. Identify the invoice-run owner.
  2. Approve harmless test content.
  3. Define when failed sends will be retried.

[ FAQs ]

Frequently asked questions

Does every KashFlow account send from the same infrastructure?

Do not assume so. IRIS documents an SMTP override that sends through the configured mail provider.

Enable IRIS KashFlow to use your email address (SMTP)

Is the KashFlow SPF include supported by a current first-party source?

Yes. The retained IRIS page specifies include:spf.kashflow.com and displays a 2 October 2026 update date.

Setting up SPF records

Should I create a second SPF record?

No. Reconcile the authorized mechanism with the single existing policy at the applicable domain.

Setting up SPF records RFC 7208 SPF

Can I state that KashFlow does not support DKIM?

Not from these sources. They do not establish a default-service customer-domain DKIM procedure or prove its absence.

Setting up SPF records Enable IRIS KashFlow to use your email address (SMTP)

Who controls DKIM when SMTP override is used?

The actual sending mail provider’s configuration must be checked. Verify the delivered signature rather than assuming KashFlow’s default route applies.

Enable IRIS KashFlow to use your email address (SMTP) RFC 6376 DKIM

Does Test Email or a sent note prove DMARC passes?

No. Inspect the receiving system’s authentication results and actual From, envelope and signing domains.

Enable IRIS KashFlow to use your email address (SMTP) Did my email send RFC 9989 DMARC

Is it safe to use a real customer invoice for public testing?

Use approved harmless content and controlled recipients. Avoid exposing customer documents or changing their saved addresses.

Email sales invoices

What remains a release gate?

The active tenant route, native-service capability answers, live DNS, received-message results and SME review remain unverified.

[ Sources ]

Sources

  1. Setting up SPF records

    Sections SPF

  2. Enable IRIS KashFlow to use your email address (SMTP)

    Sections Enable IRIS KashFlow to use your email address (SMTP) · Changing the authentication type of a Microsoft Exchange email address · Troubleshooting

  3. Email sales invoices

    Sections Email sales invoices · Email multiple invoices

  4. Did my email send

    Sections Have I emailed an invoice /quote / purchase order? · Troubleshooting

  5. RFC 7208 SPF

    Sections §3.2 · §3.3 · §4.6.4

  6. RFC 6376 DKIM

    Sections §3.5 · §3.6.2 · §6.1

  7. RFC 9989 DMARC

    Sections §4.4 · §4.7 · §4.10 · §5

[ Glossary ]

Glossary

SMTP override
KashFlow’s documented option to submit outgoing mail through a configured mail server.
SPF include
A mechanism that consults another domain’s SPF policy when authorizing a sending server.
Envelope domain
The domain in the SMTP reverse-path identity evaluated for SPF.
DKIM signing domain
The d= domain responsible for a DKIM signature, which must be evaluated separately from the visible From.
DMARC alignment
The required relationship between the visible From and a domain that passes SPF or DKIM.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base