[ Sending-service guides ]

Authenticate NICE inContact CXone ACD email on the correct delivery route

Separate ACD channel mail from system notifications, verify the sending domain, publish the issued DKIM CNAMEs, and test the actual contact-center skill.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Founder perspective on customer-service continuity
  • Mail admin perspective on CXone route evidence
  • CISO perspective on scoped assurance
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Separate ACD channel mail from system notifications, verify the sending domain, publish the issued DKIM CNAMEs, and test the actual contact-center skill.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Mail admin perspective on CXone route evidence

The domain-verification, active-domain and DKIM states answer different questions.

Next steps

  1. Retain the issued CSV and exact published owners.
  2. Use the correct region and the SPF section, not the inbound allow-list.
  3. Verify a received message from the selected ACD skill.

CISO / SecOps

CISO perspective on scoped assurance

A tested ACD route does not certify every CXone email product.

Next steps

  1. Keep Digital Experience and system notifications separate.
  2. Require evidence before claiming custom-envelope support.
  3. Preserve visual, live and SME release gates.

Founder / Non-technical

Founder perspective on customer-service continuity

Define which customer interactions must keep working through the change.

Next steps

  1. Keep inbound routing outside a narrow authentication change.
  2. Test the same agent and proactive workflows the team uses.
  3. Assign a pause and recovery decision-maker.

[ FAQs ]

Frequently asked questions

Does this guide cover Digital Experience email?

No. The reviewed NiCE setup guide concerns ACD hosted email and directs Digital Experience customers to separate instructions.

NiCE CXone: Set Up Email for ACD

Does Email Domain Status Active mean DKIM works?

No. It indicates that a skill uses the domain. Domain-verification and DKIM statuses are separate.

NiCE CXone: Set Up Email for ACD

Where do I get the DKIM records?

Use the account’s Email Domains Action operation and download the Dkim Tokens CNAME CSV. Publish its exact issued records.

NiCE CXone: Set Up Email for ACD

Can I use a system password-reset message as my ACD test?

No. System notifications and ACD channel messages are different routes. Test the actual customer-interaction workflow.

NiCE CXone User Hub System Email

Should I put every allow-list IP into SPF?

No. The inbound allow-list and outbound SPF sections serve different purposes. Use the applicable route and region instructions.

NiCE CXone User Hub System Email SPF RFC 7208

Does Amazon SES imply SPF alignment with my From domain?

No. Inspect the actual envelope. This research does not establish a universal CXone custom-return-path procedure.

NiCE CXone: Set Up Email for ACD DMARC RFC 9989

What should I check when DKIM status fails?

Compare every issued owner and target with authoritative DNS, check suffix expansion and the CNAME/key path, then repeat the provider validation and message test.

NiCE CXone: Set Up Email for ACD DNS RFC 2181

What evidence is still required?

A live account and visual walkthrough, authoritative before/after capture, controlled received-message evidence and human SME approval remain open.

[ Sources ]

Sources

  1. NiCE CXone: Set Up Email for ACD

    Sections Verify Your Email Domain · Enable DKIM for Your Email Domain

  2. NiCE CXone User Hub System Email

    Sections Types of Email · SPF Records

  3. SPF RFC 7208

    Sections §3.2 Multiple DNS Records · §3.3 Multiple Strings · §4.6.4 DNS Lookup Limits

  4. DKIM RFC 6376

    Sections §3.5 DKIM-Signature Header Field · §3.6 Key Management

  5. DMARC RFC 9989

    Sections Identifier Alignment · DMARC Policy Discovery

  6. DNS RFC 2181

    Sections §10.1 CNAME resource records

[ Glossary ]

Glossary

ACD channel email
The CXone email route used for agent/contact interactions.
Domain Verification Status
Whether the provider has validated control of the sending domain.
Email Domain Status
Whether an email skill currently uses the domain, not a DKIM result.
Dkim Tokens CSV
The account-issued file containing the public CNAME records to publish.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base