[ Sending-service guides ]

Authenticate email sent through Mailguard: configuration and verification

Confirm the MailGuard outbound gateway, authorize its sending route and obtain the tenant-specific DKIM configuration before verifying alignment on a received message.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Confirm which gateway carries mail
  • Obtain the issued DKIM setup
  • Review connector trust carefully
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Confirm the MailGuard outbound gateway, authorize its sending route and obtain the tenant-specific DKIM configuration before verifying alignment on a received message.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Obtain the issued DKIM setup

Public feature evidence does not supply a tenant-specific selector or activation procedure.

Next steps

  1. Retrieve the current signed-in instructions.
  2. Record the complete issued DNS values and signing domain.
  3. Correlate gateway logs with received-message identities.

CISO / SecOps

Review connector trust carefully

Outbound permissions and inbound filtering controls should not be changed indiscriminately.

Next steps

  1. Approve the exact tenant and network trust scope.
  2. Preserve domain-wide DMARC while diagnosing a route.
  3. Keep custom-envelope claims unconfirmed until demonstrated.

Founder / Non-technical

Confirm which gateway carries mail

Inbound protection and outbound delivery are different dependencies.

Next steps

  1. Confirm the provider and product with the account owner.
  2. Inventory mailbox, application and hybrid routes.
  3. Approve a recovery plan before connector changes.

[ FAQs ]

Frequently asked questions

Which Mailguard product does this guide address?

The MailGuard service at mailguard.com.au. The account owner must confirm that identity and the outbound product before implementation.

Feature Spotlight: Enhanced Filtering for Connectors in Microsoft 365 (Skip Listing) New Feature: Outbound DKIM Signing

Does an inbound MailGuard MX prove outbound mail uses MailGuard?

No. Inspect the outbound connector and message logs. Inbound filtering and outbound delivery can be configured separately.

Feature Spotlight: Enhanced Filtering for Connectors in Microsoft 365 (Skip Listing)

What SPF mechanism does MailGuard publish?

Its public guidance lists include:customer.mailguard.com.au. Confirm current applicability to the actual outbound tenant and merge it into the existing policy.

Feature Spotlight: SPF Records

Does MailGuard support outbound DKIM signing?

Its public feature announcement confirms support for the Australian product and identifies a domain-level DKIM console menu. The tenant's configuration still needs verification.

New Feature: Outbound DKIM Signing

Where can I get the exact DKIM selector and record value?

From the current authorized console or provider instructions. The detailed support article required login and was not inspected, so this guide supplies no guessed values.

Configure DKIM signing for outbound email: access requires MailGuard console login

Is a custom Return-Path feature established here?

No. Public outbound-signing evidence does not establish a universal custom-envelope workflow. Confirm support for the exact tenant if that feature is needed.

Should I change inbound skip listing to fix an outbound DMARC failure?

Not without a separate diagnosis and approved scope. Inbound filtering and outbound authentication address different parts of the mail path.

Feature Spotlight: Enhanced Filtering for Connectors in Microsoft 365 (Skip Listing)

What blocks production acceptance and publication?

Exact product confirmation, signed-in DKIM setup and activation, authoritative DNS and live received-message evidence, followed by independent technical and human SME review.

[ Sources ]

Sources

  1. Feature Spotlight: Enhanced Filtering for Connectors in Microsoft 365 (Skip Listing)

    Sections For Outbound Configuration · Trust Office 365 Networks · Enhanced Filtering for Connectors

  2. Feature Spotlight: SPF Records

    Sections How do you set up an SPF record? · The recommended SPF entry for any MailGuard-protected domain

  3. New Feature: Outbound DKIM Signing

    Sections New Feature: Outbound DKIM Signing

  4. Configure DKIM signing for outbound email: access requires MailGuard console login

    Sections Login - Management Console · Log in to access the MailGuard console

  5. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  6. RFC 6376 DKIM

    Sections §3.5 · §6

  7. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Outbound gateway
The service through which an organization routes mail on its way to external recipients.
Connector
A mail-system configuration that defines how a specified mail flow is routed and trusted.
Trusted Networks
MailGuard configuration governing which source networks may submit under the relevant service setup.
Signing domain
The d= domain in a DKIM signature, compared with the From domain for DMARC alignment.
Tenant-specific setup
Instructions and values belonging to the actual organization account rather than a generic product example.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base