[ Sending-service guides ]

Authenticate email sent through Acoustic: configuration and verification

Provision Acoustic Campaign domains through the documented support process, distinguish hosted DNS from supplied records, and validate the selected sending identity.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Choose From-only versus fully branded custom-domain scope first.
  • Follow the provisioning specialist and exact delegated DNS boundary.
  • Verify message identities and branded links as separate outcomes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify message identities and branded links as separate outcomes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the actual route

Use the provisioning case to control every owner, record and verification step.

Next steps

  1. Retain organization, pod and the supplied record set.
  2. Verify delegation, active selector and actual Campaign message.
  3. Retest after a sending-domain or DNS-provider change.

CISO / SecOps

Control the authorization boundary

Review delegated DNS scope and preserve evidence for key rotation and supplier retirement.

Next steps

  1. Approve only the intended subdomain delegation.
  2. Review active queues before retiring selectors or reply dependencies.
  3. Retain the approved recovery and supplier-retirement decisions.

Founder / Non-technical

Own the sending decision

Approve whether the business needs a From-only identity or a fully branded custom domain.

Next steps

  1. Choose From-only versus custom-domain scope explicitly.
  2. Confirm the provisioning order and specialist handoff.
  3. Require the controlled-message acceptance record before launch.

[ FAQs ]

Frequently asked questions

Can I create a From domain before a custom domain?

The cited Acoustic procedure says a custom domain must exist first.

Acoustic Campaign From domains

Should I follow provisioning steps immediately?

No. Acoustic explicitly requires the order, support case and specialist direction before those changes.

Acoustic Campaign From domains

Who hosts DNS on a multi-client shared IP pool?

The From-domain documentation requires Acoustic-hosted DNS for that arrangement.

Acoustic Campaign From domains

Is there one SPF include for all Acoustic configurations?

Do not assume one. Use the exact record set for your organization, pod and hosting model.

Acoustic Campaign custom domain provisioning

Should I always query spop2048?

Confirm the active selector in provisioning evidence and a real signature. Acoustic also documents spop1024 and transition coexistence.

Acoustic deliverability and performance

Why do authenticated messages still use older branded links?

A From-only configuration can use links associated with the VMTA’s existing custom domain.

Acoustic Campaign From domains

Does an SSL certificate verify email authentication?

No. Link transport security and message-domain authentication are separate controls.

Acoustic Campaign custom domain provisioning

What should trigger another test?

Changes to the domain, pod, VMTA, DNS delegation, reply route or active DKIM selector.

[ Sources ]

Sources

  1. Acoustic Campaign From domains

    Sections Details required to provision a domain · Provision a From domain

  2. Acoustic Campaign custom domain provisioning

    Sections Custom domains vs From domains · SSL certificates · Provision custom domain

  3. Acoustic deliverability and performance

    Sections How do I find the DKIM selector for my Acoustic send domain?

  4. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  7. RFC 1034 DNS concepts

    Sections §3.6.2 Aliases and canonical names · §4.2 How the database is divided into zones

  8. RFC 2308 DNS negative caching

    Sections §5 Caching Negative Answers

[ Glossary ]

Glossary

Alignment
The required relationship between a passing authentication domain and the visible From domain for DMARC.
Selector
The DKIM label used with the signing domain to locate its public key in DNS.
Authoritative DNS
The nameserver service responsible for publishing the relevant zone records.
Return-Path
The received-message trace of the SMTP reverse path, useful when investigating the envelope identity.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base