[ Sending-service guides ]

Authenticate email sent through Iterable: configuration and verification

Authenticate the ESP route behind an Iterable campaign and verify every platform bound to its message channel.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Inventory every channel-to-ESP binding, including percentage splits.
  • Separate default shared SES from external sending platforms.
  • Prove each active domain/platform route independently.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Prove each active domain/platform route independently.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Match domains to platforms

Mail admin: The correct DNS instructions depend on the ESP behind the send.

Next steps

  1. Use the default SES branch only for Iterable’s shared pool.
  2. Capture account-generated provider records.
  3. Maintain one evidence row per domain and platform.

CISO / SecOps

Require complete authentication coverage

CISO: One passing sample does not cover every bound platform.

Next steps

  1. Review all active ESP dependencies.
  2. Keep policy changes separate from migration work.
  3. Retain redacted receiver evidence for each route.

Founder / Non-technical

Protect every campaign route

Founder: A partially working platform split can hide failed customer communications.

Next steps

  1. Name an owner for critical triggers.
  2. Inventory channels before a migration.
  3. Approve expansion only after each route passes.

[ FAQs ]

Frequently asked questions

Should every Iterable customer use Settings > DNS Setup?

No. Those values apply to Iterable’s default SES configuration, not arbitrary connected ESPs.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can I connect my own SES account using the default route?

The retrieved Iterable SES guide says that bringing your own SES account is not supported.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Where do externally managed sending domains belong?

Configure them with the ESP, then associate each domain and ESP under Settings > Domains in Iterable.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why can one campaign produce different authentication outcomes?

Its channel may be bound to multiple ESP accounts. Inspect which route produced each message.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does SparkPost use the same identity for sending and bounces?

Its integration guide treats sending and bounce domains separately. Obtain and verify the configured identities rather than assuming they match.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does a verified sender prove DMARC passes?

No. Capture trusted receiver results and compare the actual authenticated domains with the visible From.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can a tracking-domain CNAME fix DKIM?

No. Tracking links and DKIM authentication use different records and serve different purposes.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What is still missing from this documentary guide?

Tenant bindings, provider-generated DNS values, live publication, received-message tests and current integration review remain unverified.

Email Setup Amazon Simple Email Service (SES) + Iterable Integration SparkPost + Iterable Integration RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Email Setup

    Sections Terms; Steps1–5; SES versus external domain configuration; channel bindings

  2. Amazon Simple Email Service (SES) + Iterable Integration

    Sections Introduction; Steps2–3; one shared sending domain, project settings and DNS Setup

  3. SparkPost + Iterable Integration

    Sections Steps1–2; subaccounts, bounce domains, IP Pool ID and no default for multi-pool setup

  4. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

ESP
The email service provider that transmits a message selected by an Iterable workflow.
Message channel
An Iterable subscription grouping that also binds email sends to configured platforms.
Sending domain
The domain configured for the campaign’s visible sender identity.
Bounce domain
The domain used for the SMTP reverse-path and delivery failures.
Aligned authentication
A passing SPF or DKIM result whose domain has the required relationship to the visible From.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base