[ Sending-service guides ]

Authenticate email sent through MailUp: configuration and verification

Configure MailUp sender authentication and, where available, Brand Shield envelope customization, then verify list-specific From, Return-Path and DKIM alignment.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Coordinate every affected list
  • Record the envelope separately
  • Control the fallback behavior
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Configure MailUp sender authentication and, where available, Brand Shield envelope customization, then verify list-specific From, Return-Path and DKIM alignment.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Record the envelope separately

SPF publication and custom Envelope Sender activation are different steps.

Next steps

  1. Verify both basic DKIM delegations.
  2. Use generated CNAMEs for envelope customization.
  3. Capture observed identities from each tested workflow.

CISO / SecOps

Control the fallback behavior

A provider-authenticated message may still lack alignment with the business From domain.

Next steps

  1. Review each passing alignment path.
  2. Keep enforced policy changes separately approved.
  3. Require the original identity table and human review.

Founder / Non-technical

Coordinate every affected list

A sender migration can involve campaigns, automations and shared account-level tracking.

Next steps

  1. Inventory active list defaults.
  2. Confirm account feature availability.
  3. Approve rollout only after route-specific tests.

[ FAQs ]

Frequently asked questions

Does MailUp automatic authentication prove my domain is aligned?

No. Inspect the actual envelope and signing domains; provider fallback authentication is not evidence of customer-domain DMARC alignment.

Senders authentication

Which basic SPF include is documented?

MailUp documents include:musvc.com. Confirm the current account requirements and merge it without creating a second SPF policy.

SPF: no record found

Why are there two basic DKIM CNAMEs?

The provider instructs publication of both ml01 and ml02 selectors. Keep both unless current provider instructions authorize a change.

DKIM: no record found

Can I invent a TXT replacement for a blocked CNAME?

No. MailUp directs customers to contact support for its TXT alternative.

DKIM: no record found

What does a pending custom Envelope Sender mean?

The cited guide says customization has not completed and the shared MailUp envelope remains in use. Check the generated CNAME and reverify.

Envelope Sender (Spanish user guide, updated June 20 2025)

Does the advanced tracking domain affect only one list?

The first-party guide describes one domain applied across all lists in the platform. Review the cross-list impact before changing it.

Advanced Customization of Second-Level Tracking Domain

Will deleting a verified sender immediately stop its campaigns?

No. MailUp says existing sends continue using it until their configuration is modified. Pause or modify the actual sending workflows.

Senders authentication

What evidence is still missing?

Account entitlement and current configuration, original received-message identity rows for the actual lists and workflows, FAQ relevance review and human SME approval.

[ Sources ]

Sources

  1. Senders authentication

    Sections Authentication · Deleting Verified Senders

  2. SPF: no record found

    Sections Adding SPF authentication · More information: why the From domain and how it all works

  3. DKIM: no record found

    Sections Adding DKIM authentication · What happens if it's missing

  4. Envelope Sender (Spanish user guide, updated June 20 2025)

    Sections La lista de dominios · Configurar el Envelope Sender para un dominio · Resolución de problemas

  5. Advanced Customization of Second-Level Tracking Domain

    Sections Tracking Domain Status · Tracking Domain Selection · CNAME Record Configuration

  6. DKIM signature not aligned with DMARC record.

    Sections What to do. · Learn about Brand Shield

  7. Brand Shield

    Sections Brand Shield: the video tutorial to align your domain! · Also read the insights and guides:

  8. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  9. RFC 6376 DKIM

    Sections §3.5 · §6

  10. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Verified sender
An email address MailUp has accepted for use as a sender; this alone does not prove aligned domain authentication.
Brand Shield
MailUp’s documentation area for coordinating branded sending and tracking identities.
Custom Envelope Sender
A configured customer-domain envelope identity used for delivery feedback and SPF evaluation.
Pending envelope state
The documented state in which customization is incomplete and the shared MailUp envelope remains in use.
Advanced tracking domain
The account-wide branded domain configuration for tracking links and hosted images.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base