[ Sending-service guides ]

Authenticate NoSpamProxy Cloud and Server outbound email

Choose the Cloud or Server setup deliberately, publish the issued DNS data, enable the correct signing control, and verify the message after all gateway processing.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Founder perspective on protecting gateway changes
  • Mail admin perspective on completing the signing chain
  • CISO perspective on gateway trust and keys
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Choose the Cloud or Server setup deliberately, publish the issued DNS data, enable the correct signing control, and verify the message after all gateway processing.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Mail admin perspective on completing the signing chain

Cloud DNS onboarding and Server rule-based signing are different procedures.

Next steps

  1. For Server, prove key, domain activation and rule action.
  2. Compare internal resolver answers with public DNS.
  3. Test special content classes and bypass routes separately.

CISO / SecOps

CISO perspective on gateway trust and keys

Require evidence from the delivered message after gateway processing.

Next steps

  1. Protect private key exports and preserve necessary public keys.
  2. Treat the TCP-proxy SPF exception as narrowly scoped.
  3. Document unsupported signing cases and retain independent approval gates.

Founder / Non-technical

Founder perspective on protecting gateway changes

Authentication work can affect every workflow through the gateway.

Next steps

  1. Name the deployed product and business-critical routes.
  2. Keep MX migration separate from a signing correction.
  3. Require recovery ownership before changing shared rules.

[ FAQs ]

Frequently asked questions

Can I use the same setup for Cloud and Server?

No. Cloud supplies domain-specific managed DNS configuration; Server requires key management, corporate-domain activation and a signing action in the applicable rule.

NoSpamProxy Cloud: Setting up the DNS configuration NoSpamProxy Server 16: DKIM keys

How many DKIM CNAMEs does the Cloud guide require?

It documents four permanent CNAME entries from the selected domain’s DNS configuration. Use the actual issued values.

NoSpamProxy Cloud: Setting up the DNS configuration

Does standalone Encryption require ordinary Cloud MX and DKIM changes?

The guide says not for standalone Encryption without Protection, and separately specifies an SPF exception for its TCP-proxy route. Confirm your deployment branch.

NoSpamProxy Cloud: Setting up the DNS configuration

Does generating a Server key turn on signing?

No. Activate the verified key for the corporate domain and ensure the relevant outbound rule applies the DKIM signature action.

NoSpamProxy Server 16: DKIM keys NoSpamProxy Server 16: Activating DKIM NoSpamProxy Server 16: Apply DKIM signature

Why can public DNS work while gateway validation fails?

The configured internal resolver may see different data. The Server activation guide specifically addresses Intranet Role DNS that cannot resolve public entries.

NoSpamProxy Server 16: Activating DKIM

What if the message uses a special outbound rule?

Trace that rule and its Local sender classification and signing action. A key configured elsewhere does not prove that this message is signed.

NoSpamProxy Server 16: Apply DKIM signature

Does a plain-text test cover encrypted or digitally signed mail?

No. The Cloud rules document specific restrictions for those classes. Test the supported production workflow and record limitations separately.

NoSpamProxy Cloud: Rules

What still needs review?

The actual module/version scope, live account and rule checks, DNS before/after evidence, protected-content behavior, received-message results and human SME approval remain open.

[ Sources ]

Sources

  1. NoSpamProxy Cloud: Setting up the DNS configuration

    Sections Domain verification · SPF · DKIM · Encryption standalone

  2. NoSpamProxy Server 16: DKIM keys

    Sections Adding DKIM keys · Enabling DKIM for corporate domains

  3. NoSpamProxy Server 16: Activating DKIM

    Sections Activating DKIM

  4. NoSpamProxy Server 16: Apply DKIM signature

    Sections Apply DKIM signature

  5. NoSpamProxy Cloud: Rules

    Sections All outbound emails

  6. SPF RFC 7208

    Sections §3.2 Multiple DNS Records · §3.3 Multiple Strings · §4.6.4 DNS Lookup Limits

  7. DKIM RFC 6376

    Sections §3.5 DKIM-Signature Header Field · §3.6 Key Management

  8. DMARC RFC 9989

    Sections Identifier Alignment · DMARC Policy Discovery

[ Glossary ]

Glossary

Corporate-domain activation
The Server step that associates a verified DKIM key with a sending domain.
Apply DKIM signature
The Server rule action that adds a signature to eligible outbound messages.
Local sender classification
The sender scope for which the documented signing action applies.
TCP-proxy exception
A standalone Encryption route with its own documented SPF requirement.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base