[ Sending-service guides ]

Authenticate email sent through Forpsi: configuration and verification

Match FORPSI DKIM activation to DNS ownership, authenticate the actual SMTP route, and keep website mail separate from mailbox tests.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Match DKIM activation to DNS and account ownership.
  • Test main, alias and website routes separately.
  • A working mailbox does not validate a web script.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

A working mailbox does not validate a web script.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the complete sending route

The product panel, DNS and receiving mailbox establish different facts.

Next steps

  1. Preserve the exact generated values and prior DNS state.
  2. Inspect a received message from hosted mailbox and website mail.
  3. Record From, envelope domain, DKIM d=/s= and receiver results.

CISO / SecOps

Keep authority and recovery explicit

A signing delegation authorizes use of a domain identity; its scope needs review.

Next steps

  1. Approve the service and signing domain before delegation.
  2. Retain a tested recovery route for hosted mailbox and website mail.
  3. Require human review before stronger enforcement or removing old records.

Founder / Non-technical

Protect hosted mailbox and website mail

Authentication is part of a controlled service change, not an inbox-placement guarantee.

Next steps

  1. Name the business owner of hosted mailbox and website mail.
  2. Approve the intended sender and reply identities.
  3. Require a successful workflow test before broad rollout.

[ FAQs ]

Frequently asked questions

Does FORPSI hosting authenticate every website email?

No. The documented activation covers smtp.forpsi.com. Treat local mail() and other SMTP servers as separate sending routes.

FORPSI: DKIM

Is DKIM automatic for every domain?

The provider conditions automatic setup on DNS and customer-account ownership. Check the actual DKIM tab rather than assuming it.

FORPSI: DKIM

Do alias domains need their own check?

Yes. The hosting interface activates the main and alias domains separately.

FORPSI: DKIM

Where do I find the public key again?

Use View public key - TXT record in the DKIM workflow and compare its exact owner and value with authoritative DNS.

FORPSI: DKIM

Which SPF include is documented for FORPSI SMTP?

include:_spf.forpsi.com. Review the whole existing SPF policy before adding it.

FORPSI: Setting of SPF and DMARC records

What if edit DNS records is missing?

The provider says the domain is not using its nameservers. Make the change at the actual authoritative DNS service.

FORPSI: Setting of SPF and DMARC records

Why can webmail work while a web form fails?

The form may use a different SMTP server, envelope sender or signing path. Compare actual headers and application settings.

FORPSI: Sent emails are not delivered or are delivered into the SPAM folder

Does no bounce mean inbox delivery?

No. Retain delivery logs and receiver evidence; acceptance or silence does not establish inbox placement or readership.

[ Sources ]

Sources

  1. FORPSI: DKIM

    Sections Activating DKIM; three ownership/DNS cases; signing limitations

  2. FORPSI: Setting of SPF and DMARC records

    Sections Values of the Forpsi record; DNS administration; external services

  3. FORPSI: Sent emails are not delivered or are delivered into the SPAM folder

    Sections DKIM section: SMTP-only and From/envelope domain condition; failure diagnosis

  4. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  5. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  6. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

DKIM
A signature mechanism that associates signed message data with a signing domain.
SPF
A mechanism by which an envelope domain authorizes sending hosts.
DMARC alignment
The relationship required between the visible From domain and a successfully authenticated SPF or DKIM domain.
Selector
The label used with a DKIM signing domain to locate its public key.
Authoritative DNS
The DNS servers responsible for the published data of a zone.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base