Authenticated business email across four sending domains
The whole sending stack for a B2B services business: domain authentication, DNS, mailboxes and the outreach tools on top, set up so mail providers trust it and forged mail is much harder to pass off as the business.
- Business
- A B2B services business with four sending domains
- Work
- Build and secure
- Tools
- Cloudflare DNS, Google Workspace, Instantly, Apollo
- Result
- SPF, DKIM and DMARC passing on all four domains
The starting point
A business sending outbound email from several domains. Without authentication, mail providers have no reason to trust that mail, and forged mail using the business's domain is hard for them to tell apart from the real thing.
What was built
VXSec set up the whole stack. DNS for every domain runs in Cloudflare. Each domain publishes SPF, signs its mail with DKIM, and has a DMARC policy. The main domain's SPF ends in a hard fail, and its DMARC policy asks receiving mail servers to quarantine mail that fails the checks, so forged mail from that domain is far less likely to reach an inbox.
Google Workspace mailboxes sit on the sending domains, the outreach tools are connected on top, and DMARC aggregate reports go to mailboxes the business owns, so failures and spoofing attempts show up in writing.
One thing running it taught: an outreach tool's inbox-placement score measures its own warm-up network, not real recipients' mail servers. Passing authentication is where deliverability work starts, not where it ends. Reputation on a young domain and a link that matches the sending domain matter too.
The result
An audit found SPF, DKIM and DMARC passing on all four domains, with the main domain's hard-fail SPF and quarantine DMARC policy confirmed on a later check.
What needs building or fixing?
Tell VXSec what the system does, what you want to change, and what is getting in the way. Include links if you have them. Within two business days you get a written reply with the next step.
Or email [email protected]