[ Sending-service guides ]

Authenticate email sent through Loops.so: configuration and verification

Set up Loops.so with account-generated domain records, preserve existing inbox routing and verify both marketing and transactional message identities.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Publish the exact envelope-subdomain records without replacing inbox MX.
  • Use actual randomized DKIM selectors rather than common-name guesses.
  • Verify From, replies and each real application-triggered route.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Verify From, replies and each real application-triggered route.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Preserve inbox routing

The envelope subdomain has different responsibilities from the corporate inbox domain.

Next steps

  1. Use account-generated record names.
  2. Keep root MX intact.
  3. Test the actual application-triggered route.

CISO / SecOps

Verify alignment under the real policy

An envelope subdomain and a DKIM signature need comparison with the actual From identity.

Next steps

  1. Check strict versus relaxed modes.
  2. Preserve existing DMARC enforcement.
  3. Retain restricted original-message evidence.

Founder / Non-technical

Protect product mail continuity

Domain work can affect both campaigns and time-sensitive application messages.

Next steps

  1. Inventory production send paths.
  2. Approve visible sender changes.
  3. Keep a working fallback during validation.

[ FAQs ]

Frequently asked questions

Can I use a free hosting-platform subdomain?

Loops requires control of the necessary DNS records; its guide excludes free platform subdomains that do not provide that control.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Must I create an A record for the sending subdomain first?

No. The cited Loops guide says it provides the records needed, without a preliminary A or CNAME for that purpose.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Does Loops SPF replace my corporate root SPF policy?

Its documented SPF owner is the envelope subdomain. Review that exact owner and preserve unrelated root-domain authorization.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can the Loops MX replace my inbox MX records?

No. Its envelope MX handles delivery feedback and is separate from ordinary inbox routing.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why does a common-selector checker miss my DKIM?

Loops uses randomized selectors. Retrieve the exact hostname from the account records page.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is Reply the same as From?

No. Reply controls the response destination; From uses the configured sending domain. If Reply is blank, replies go to From.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I test only a preview email?

No. Test the actual campaign, workflow or transactional route being approved, with controlled recipients and harmless content.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What remains before acceptance?

Account applicability, live DNS, received-message identity rows for the exact routes and human SME approval remain unverified.

Setting up your domain Free DNS checker for email authentication Sending settings RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Setting up your domain

    Sections Steps1–3 lines104–147; exact envelope owner and DNS-only CNAME

  2. Free DNS checker for email authentication

    Sections Records13–21; randomized selectors45–46; verification30

  3. Sending settings

    Sections Name/From/Reply127–130; CC/BCC135–136

  4. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  5. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  6. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Sending domain
The domain configured in Loops for the visible sender address.
Envelope subdomain
The separate domain Loops documents for SPF and bounce-related routing.
Randomized selector
An account-specific DKIM selector that cannot be reliably found by probing common names.
DNS Only
A Cloudflare setting that publishes the record without its HTTP proxy.
Transactional route
An application-triggered message path that must be tested separately from an editor preview.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base