[ Sending-service guides ]

Authenticate email sent through Flexmail: configuration and verification

Validate Flexmail senders, generate domain records, configure the return-path and understand the different consequences for marketing and transactional mail.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Validate each sender address and authenticate each domain.
  • Separate published DNS from server-side key installation.
  • Removing return-path can reject transactional mail.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Removing return-path can reject transactional mail.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Read the two DKIM signals

DNS publication and server-side installation are different states.

Next steps

  1. Retain the generated report.
  2. Check authoritative DNS.
  3. Verify the return-path and actual message identities.

CISO / SecOps

Control changes to delegated trust

Sender approval and DNS delegation serve different purposes.

Next steps

  1. Keep address approvals auditable.
  2. Review selector collisions.
  3. Require an impact review before return-path removal.

Founder / Non-technical

Protect transactional continuity

Return-path removal can stop operational mail.

Next steps

  1. List transactional dependencies.
  2. Approve the change window.
  3. Require separate campaign and transactional tests.

[ FAQs ]

Frequently asked questions

Must I validate every sender address?

Yes. Sender permission is per address, while domain authentication covers the domain.

Flexmail: Sender validation and email authentication

Can an unreadable no-reply mailbox be validated?

Not through this documented flow. Someone must receive and act on the confirmation email.

Flexmail: Sender validation and email authentication

Where do the DNS values come from?

Generate DKIM keys in Set up authentication, then download Generate report for the domain’s current record set.

Flexmail: Sender validation and email authentication

Must the DKIM selector be flexmail?

That is the documented default, not a reason to overwrite an existing selector. Coordinate any change with the administrator.

Flexmail: Sender validation and email authentication

Why can DKIM be red while the badge is green?

Flexmail says DNS may already be correct while server-side installation is processing. Check both signals before editing again.

Flexmail: Sender validation and email authentication

Does a bounce subdomain satisfy strict SPF alignment?

Not when the visible From domain differs. Strict alignment requires exact domains; an aligned DKIM path can independently satisfy DMARC.

What happens if I remove the return-path?

The documentation says transactional messages are rejected until a validated return-path exists again, while marketing falls back to the shared default.

Flexmail: Sender validation and email authentication

Is one campaign test sufficient for transactional mail?

No. Test each active route, particularly after changing or removing the return-path.

[ Sources ]

Sources

  1. Flexmail: Sender validation and email authentication

    Sections Before you start · Part 1: Validate a new sender address · Part 2: Set up email authentication · Setting up, changing, and removing a return path · Verify that authentication is active

  2. RFC 9989: DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

  3. RFC 7208: SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376: DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

[ Glossary ]

Glossary

Alignment
The relationship between the visible From domain and a successfully authenticated SPF or DKIM identity under the applicable DMARC mode.
Selector
The DKIM label identifying which public-key record the verifier queries.
Envelope sender
The SMTP identity used for delivery errors and normally evaluated by SPF; it is distinct from the visible From field.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base