[ Sending-service guides ]

Authenticate email sent through Beamery: configuration and verification

Connect Beamery sender authentication and branded links as separate changes, with explicit ownership of the chosen subdomains.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Choose an unused technical name and preserve existing services.
  • Verify custom domains and branded links separately.
  • Test the selected campaign identity after default-domain changes.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test the selected campaign identity after default-domain changes.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Separate the two configurations

Sender authentication and branded links need their own checks.

Next steps

  1. Publish generated records only.
  2. Verify both screens where used.
  3. Retain actual message identities.

CISO / SecOps

Avoid accidental delegation

A mail CNAME can displace another service.

Next steps

  1. Check existing DNS owners.
  2. Review apex-domain policy.
  3. Exclude candidate data from tests.

Founder / Non-technical

Keep recruiters on the approved identity

Domain defaults affect campaign operations.

Next steps

  1. Name a campaign owner.
  2. Approve the chosen subdomain.
  3. Require a controlled campaign test.

[ FAQs ]

Frequently asked questions

Must the subdomain be careers?

No. Choose an unused name suitable for your organization; Beamery’s common examples are not mandatory values.

Sender Authentication Fact Sheet – Beamery

Will recruiters have to use a subdomain mailbox address?

The fact sheet distinguishes the technical subdomain from the normal visible sending domain. Verify the actual From address in your test.

Sender Authentication Fact Sheet – Beamery

Can I paste the numbered SendGrid sample?

No. Publish the records generated for your own Beamery account and domain.

Sender Authentication Fact Sheet – Beamery

Where do I start domain setup?

Use Settings > Email Settings > Custom Domain > Add Your Domain.

Setting Up Custom Email Domains and Branded Tracking Links – Beamery

Does branded-link verification prove DMARC?

No. Test link behavior and received-message authentication separately.

Setting Up Custom Email Domains and Branded Tracking Links – Beamery

Can I reuse the careers website hostname?

Not without understanding and approving the existing dependency. Prefer a free technical label.

What if apex-domain sending is prohibited?

Beamery says this requires advanced configuration with its technical team. Obtain that supported design first.

Sender Authentication Fact Sheet – Beamery

What should be retested after changing the default domain?

The intended campaign’s actual From, signing identity, envelope identity and any branded test link.

[ Sources ]

Sources

  1. Setting Up Custom Email Domains and Branded Tracking Links – Beamery

    Sections How to set up a Custom Domain in Beamery Settings · How to set up Branded Tracking Links in Beamery Settings

  2. Sender Authentication Fact Sheet – Beamery

    Sections What is Sender Authentication · Sample three-CNAME table · FAQs: subdomains and apex-domain restrictions

  3. RFC 7208

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  5. RFC 9989

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
DNS authorization for the SMTP envelope-sender domain, subject to protocol limits.
DKIM
A signature verified using a public key at a selector under the signing domain.
DMARC alignment
The required relationship between the visible From domain and a passing SPF or DKIM authentication domain.
Authoritative DNS
The delegated DNS service responsible for the published zone answers.
Selector
The DKIM identifier used with the signing domain to locate the public key.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base