[ Sending-service guides ]

Authenticate email sent through AuthSMTP: configuration and verification

Authenticate the actual AuthSMTP sending domain, including the important exception for messages that arrive already DKIM-signed.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Determine whether the application or relay supplies the signature.
  • Use the domain-generated DKIM values and one complete SPF policy.
  • Test pre-signed and unsigned paths without inventing test results.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test pre-signed and unsigned paths without inventing test results.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Trace each signature

A published relay key cannot repair an application-side signature.

Next steps

  1. Record the application signer.
  2. Check authoritative selector answers.
  3. Compare the delivered signing domain with From.

CISO / SecOps

Avoid ambiguous authorization

Keep domain permissions and signing responsibilities auditable.

Next steps

  1. Review all active SPF senders.
  2. Protect private signing material.
  3. Retire old selectors only after dependency checks.

Founder / Non-technical

Assign the signer

Make relay and application ownership explicit.

Next steps

  1. Approve a harmless test for each application.
  2. Name who can pause a broken route.
  3. Require received-message evidence before expansion.

[ FAQs ]

Frequently asked questions

Will AuthSMTP add a signature to a message my app already signed?

Its documented behavior is to preserve the existing signature without adding an AuthSMTP signature. Inspect the application signer.

DKIM Signing with AuthSMTP | AuthSMTP

Can I reuse the sample selector?

Use the selector and destination generated for your domain. A plausible example is not an account configuration.

DKIM Signing with AuthSMTP | AuthSMTP

Should I publish a second SPF policy for AuthSMTP?

No. Incorporate the authorized include into the single applicable SPF policy and preserve other active senders.

SPF Setup for AuthSMTP | AuthSMTP

Why does relay authorization require all three mechanisms?

That is AuthSMTP’s service baseline. It is stricter than DMARC’s one-aligned-path minimum.

AuthSMTP Getting Started Guide

What should the application owner provide?

The intended From identity, actual relay account, signing responsibility and a safe way to exercise the normal send path.

What if a selector already contains a TXT record?

Establish who uses it before any replacement. TXT and CNAME cannot be combined at that owner.

DKIM Signing with AuthSMTP | AuthSMTP

Does an SMTP success prove authentication?

No. It proves acceptance at that SMTP step; retain the final receiver’s authentication results separately.

When is this change complete?

When each intended application route has matching DNS and observed aligned authentication, with a recoverable previous configuration.

[ Sources ]

Sources

  1. DKIM Signing with AuthSMTP | AuthSMTP

    Sections Required for AuthSMTP domain authorisation · Use the CNAME method for new configurations · Publish and verify the record · If your application already signs messages

  2. AuthSMTP Getting Started Guide

    Sections Step 3 - Setting up your account · Step 4 - Important Note

  3. SPF Setup for AuthSMTP | AuthSMTP

    Sections Include AuthSMTP in your existing record · Check the whole sending estate

  4. RFC 7208

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
DNS authorization for the SMTP envelope-sender domain, subject to protocol limits.
DKIM
A signature verified using a public key at a selector under the signing domain.
DMARC alignment
The required relationship between the visible From domain and a passing SPF or DKIM authentication domain.
Authoritative DNS
The delegated DNS service responsible for the published zone answers.
Selector
The DKIM identifier used with the signing domain to locate the public key.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base