[ Sending-service guides ]

Authenticate email sent through Docebo: configuration and verification

Configure a Docebo email sender domain using the built-in service or custom SMTP, with route-specific DNS, sender authorization and notification tests.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Keep the learning-site domain distinct from the mail domain.
  • Built-in DNS validation and custom SMTP validation test different controls.
  • Restore an approved route before deleting a sender-domain dependency.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Restore an approved route before deleting a sender-domain dependency.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Keep DNS and transport evidence together

The panel status, authoritative DNS answer and received message prove different parts of setup.

Next steps

  1. Save before-and-after DNS values and ownership.
  2. Test every actual sending transport and expected reply path.
  3. Record From, envelope, DKIM d/s and trusted receiver results.

CISO / SecOps

Review delegated trust and recovery

Authentication authorizes specific infrastructure and identities, not a provider name in the abstract.

Next steps

  1. Review the scope of DNS delegation or signing authority.
  2. Require secure credential handling and least-necessary access.
  3. Retire obsolete records only after dependency review and approval.

Founder / Non-technical

Approve the route before the rollout

Docebo setup changes can affect customer-facing mail and replies.

Next steps

  1. Assign the business owner of each workflow.
  2. Approve the chosen sending and reply identities.
  3. Require a controlled production-route test before rollout.

[ FAQs ]

Frequently asked questions

Can I reuse the learning-platform custom domain for email?

Docebo warns against reusing custom or secondary platform domains because DNS configurations can conflict. Choose a different, related email domain.

Docebo configuring email domains

Does creating the sender domain create an inbox?

No. Create mailboxes separately with your mail provider if recipients should be able to reply.

Docebo configuring email domains

Why is Custom SMTP unavailable?

The Custom SMTP app must be active. Without it, the platform uses the built-in email service.

Docebo configuring email domains

Which DNS values should I publish for built-in sending?

Use the SPF and DKIM settings displayed for the current domain and check the complete required DNS configuration, including MX. Do not reuse another installation’s keys.

Docebo configuring email domains

Are TLS and StartTLS interchangeable?

No. In the documented interface TLS means implicit TLS, typically port 465, while StartTLS upgrades an existing connection, typically port 587. Match your SMTP provider.

Docebo configuring email domains

Does Test connection prove permission to send as my notification address?

No. The SMTP account also needs the external provider’s send-as authorization for the selected address, and a received-message test must verify authentication.

Docebo configuring email domains

How do I repeat validation after saving?

Use Check validation from the sender-domain list’s ellipsis menu. It checks DNS for the built-in service or the SMTP connection for a custom sender.

Docebo configuring email domains

Is deleting the domain a safe rollback?

No. Docebo warns that affected mail can fall back to an untrusted SMTP gateway. Re-establish and test an approved working sender before deleting any dependency.

Docebo configuring email domains

[ Sources ]

Sources

  1. Docebo configuring email domains

    Sections Introduction · Prerequisites: Domain name and Mailboxes · Adding an email sender domain · Built-in email service · Custom SMTP option · Managing email sender domains

  2. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  3. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  4. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

DKIM selector
The s= label used with a signature’s d= domain to locate its public key in DNS.
Envelope domain
The domain of the SMTP sender identity evaluated by SPF; it may differ from the visible From domain.
DMARC alignment
The required domain relationship between the visible From and a passing SPF or DKIM identity.
Authoritative DNS
The delegated DNS service responsible for the published records of a domain or zone.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base