[ Sending-service guides ]

Authenticate Odoo email through the correct relay and alias domain

Choose the Odoo relay or external-provider branch, preserve reply and bounce routing, and verify each company’s actual sending identities.

By the EmailAuth research team · 8 min read

[ Key points ]

  • Distinguish default Odoo relay from independent SMTP providers.
  • Preserve company alias and existing-reply routing dependencies.
  • Test transaction and marketing servers separately after connection checks.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test transaction and marketing servers separately after connection checks.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Follow the actual outgoing transport

Odoo relay records do not authenticate an independent SMTP provider.

Next steps

  1. Record hosting model, version, alias domain and server selection.
  2. Apply only the selected provider’s current public records.
  3. Test a received message after the connection check.

CISO / SecOps

Require route-specific evidence

One database may contain multiple companies and sending transports.

Next steps

  1. Preserve existing sender permissions and inbound dependencies.
  2. Keep credentials and private keys out of the review package.
  3. Require alignment evidence and human approval per route.

Founder / Non-technical

Keep invoices and replies working

Authentication changes can affect operational correspondence as well as delivery.

Next steps

  1. Identify the company and business workflow.
  2. Keep transactional and marketing acceptance separate.
  3. Approve reply continuity before changing aliases.

[ FAQs ]

Frequently asked questions

Should every Odoo installation publish Odoo relay DNS records?

No. They apply to the documented Odoo sending-service branch. External SMTP and on-premises routes need their actual provider or MTA configuration. For the Odoo Online custom-domain branch, its documentation specifically requires DKIM for DMARC.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Which Odoo version supports the paths in this article?

The research uses Odoo 19 documentation. Confirm the installation version and hosting model before following the paths.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Which identity matters for Odoo SPF?

The DNS guide ties SPF to the bounce address associated with the Alias Domain setting. Verify the actual envelope identity in a received message.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Does Test Connection prove that email will authenticate?

No. It checks connectivity. Provider restrictions, sender authorization and signing still require an actual received-message test.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Why did the From address become a notification address?

Review the selected outgoing server, FROM filtering and alias settings. The configured transport can use or override a different sender than the business expected.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Can invoices and marketing campaigns use different servers?

Yes. Odoo documents separate transactional and mass-mailing server selection. Test them independently.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

Can I change the catchall alias while fixing DKIM?

Only as a separately planned routing change. Preserve replies to existing messages and verify the inbound path; DKIM work alone does not require an alias change.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

What evidence is still pending?

Tenant inspection, authoritative DNS, actual received messages, visual review and human subject-matter approval are pending.

Odoo 19 DNS records for sending email Odoo 19 sending emails RFC 7208 Sender Policy Framework RFC 6376 DomainKeys Identified Mail RFC 9989 Domain based Message Authentication Reporting and Conformance

[ Sources ]

Sources

  1. Odoo 19 DNS records for sending email

    Sections SPF; DKIM; DMARC; Odoo Online custom-domain signing note

  2. Odoo 19 sending emails

    Sections Custom domain with Odoo server; external SMTP; FROM filtering; port restriction; alias domain

  3. RFC 7208 Sender Policy Framework

    Sections §3.2; 3.3; 4.6.4

  4. RFC 6376 DomainKeys Identified Mail

    Sections §3.5; 3.6.2; 6.1

  5. RFC 9989 Domain based Message Authentication Reporting and Conformance

    Sections §4.4; 4.7; 4.10; 5; Appendix A.6 removal of pct

[ Glossary ]

Glossary

Alias domain
Odoo’s company-related domain setting used to construct application email identities.
FROM filtering
Odoo’s outgoing-server selection control based on a sender address or domain.
Transport
The mail server or service that submits the message to recipients.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base