Consultants using outside email services keep asking us to add SPF and DKIM records for our domain, but the instructions don't always explain what the records do. How do you verify the setup without blocking a legitimate request?
How do you handle email authentication requests from consultants?
Asked by
Varnel.63
Answers
Ask for the sending domain, the proposed DNS records, and a test message with full headers. Then check the authentication results against what they asked you to configure. A screenshot of a vendor checklist won't tell you whether the actual message is using the right domains.
CNAMEs for DKIM selectors are common. They can point to keys managed by the sending service, so the fact that the requested records are CNAMEs isn't a problem by itself. A CNAME can also be part of a delegated return-path setup. Check exactly what name is being delegated and who controls the target before approving it.
Reply to this answer
Start with the distinction between passing authentication and passing DMARC. SPF normally checks the envelope sender domain, not the visible From address. DKIM checks a signature associated with its signing domain. For DMARC, at least one of those checks must pass and its domain must align with the visible From domain.
So a message can pass SPF for the provider's domain and still fail SPF alignment. Aligned DKIM may be enough for DMARC, but don't assume that tells you everything about delivery. Inspect a real test message and its Authentication-Results headers, including the domains used for SPF and DKIM.
Varnel.63:
That helps. A passing SPF result alone doesn't tell me whether it aligns with the address recipients see.
Reply to this answer
Give external senders a defined subdomain where practical, rather than letting every application send as the main domain. It makes ownership and troubleshooting clearer, and you can decide what DNS changes and sending permissions belong to that service.
That doesn't make the setup risk free. Review who controls the provider account, require appropriate account security, and have a plan to remove the delegation when the service is retired.
Reply to this answer
DMARC passing is not a promise that a message will reach the inbox. Recipient providers can impose additional authentication rules, especially for bulk senders, and filtering can still affect placement. Check the current requirements for the destinations and volume involved rather than treating one passing check as the whole test.
Reply to this answer
Make the request a short change proposal. What application is sending, what From address will it use, what records are needed, and who owns the service? Then send a test to an address you can inspect. If the message uses the wrong From address, fix that before changing DNS again.
Reply to this answer
Add your answer
Answers are reviewed before publication.
gently-underlined_8:
Also check whether the requested records already exist. Another team may have set up the same service for that domain, although the consultant should confirm the existing configuration works for their account.