[ Sending-service guides ]

Authenticate email sent through Mailjet: configuration and verification

Validate and authenticate Mailjet senders at the correct API-key scope, then distinguish aligned DKIM from a separately activated custom Return-Path.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Validate each active API-key/domain combination.
  • Custom Return-Path requires eligible account and support activation.
  • Use aligned DKIM independently of shared bounce-domain scope.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Use aligned DKIM independently of shared bounce-domain scope.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify ownership and signing separately

Domain validation, SPF/DKIM and Return-Path activation are distinct steps.

Next steps

  1. Check the correct API key.
  2. Use complete account-generated records.
  3. Inspect a fresh received message after activation.

CISO / SecOps

Review multi-brand trust

One bounce domain per key can leave some SPF identities unaligned.

Next steps

  1. Evaluate the actual DMARC alignment mode.
  2. Require aligned DKIM for each sender.
  3. Review rotation and recovery evidence.

Founder / Non-technical

Keep brands and accounts mapped

A company-wide domain list can hide API-key-specific setup.

Next steps

  1. Name each active integration.
  2. Decide which brands need custom bounce domains.
  3. Approve routing changes before rollout.

[ FAQs ]

Frequently asked questions

Does domain validation cover every Mailjet subaccount?

No. Mailjet documents validation at API-key scope, so verify the domain for every subaccount that will use it.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is ownership validation the same as SPF and DKIM setup?

No. Record ownership validation and authentication separately, then verify the received message from the actual route.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Where should the Mailjet DKIM key come from?

Copy the complete current value from the selected account’s SPF/DKIM Authentication area, not a truncated example or another tenant.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I customize Return-Path by adding DNS alone?

No. The documented paid-account option also requires validation and support activation for the intended API key.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can one API key have several custom Return-Paths?

The cited documentation permits one active custom Return-Path per key. Design multi-brand routing around that constraint.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Will an unaligned default Return-Path always fail DMARC?

No. An aligned passing DKIM signature can satisfy DMARC even when the SPF identity is unaligned.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why might the Regenerate Key control be unavailable?

Mailjet requires the whole domain to be validated for regeneration; verifying only a sender address is insufficient.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What evidence is still required before acceptance?

A current original message for every material key/domain route, live DNS checks and human SME approval remain open.

How to validate an entire sending domain? – Mailjet Help Center Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center Can I customize the return-path header with Mailjet? – Mailjet Help Center How many senders can be added to my account? – Mailjet Help Center RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. How to validate an entire sending domain? – Mailjet Help Center

    Sections Two validation methods28; per-key scope30; file/DNS procedures

  2. Authenticating Domains with SPF and DKIM: A Complete Guide – Mailjet Help Center

    Sections SPF/DKIM configuration; key-size caveats; whole-domain prerequisite119; regenerate122–126

  3. Can I customize the return-path header with Mailjet? – Mailjet Help Center

    Sections Default28; CNAME29–33; support activation and paid/one-per-key limitations

  4. How many senders can be added to my account? – Mailjet Help Center

    Sections Sender/API-key scope, one custom Return-Path/tracking host, multi-brand DKIM explanation

  5. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  6. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  7. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

API-key scope
The Mailjet key or subaccount to which validation and route settings apply.
Ownership validation
The account check demonstrating control of a sender domain.
Custom Return-Path
An account-activated customer bounce domain replacing the default provider envelope identity.
Key regeneration
Replacement of DKIM signing material requiring coordinated DNS publication.
Multi-brand route
A sending integration handling more than one visible From domain.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base