Summary
When sending emails through third-party platforms like Amazon SES or Mailchimp, a common concern for senders is how their domain appears in the signed by header. Ideally, you want your own domain displayed to reinforce brand identity and improve trust. This display depends heavily on proper email authentication, specifically DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) alignment. While Mailchimp often handles this seamlessly for its users, Amazon SES and other services might require more granular configuration to ensure your domain is correctly recognized as the signing entity, rather than the sending platform itself. Achieving this alignment is critical for deliverability and avoiding via tags.
Key findings
- DKIM importance: Implementing DKIM for each domain and service provider is essential to remove Sent via [service] options and show your domain as the signing entity.
- DMARC alignment: DMARC works by checking if the header from domain aligns with either the SPF return-path domain or the DKIM d= domain. Achieving this alignment ensures your domain is recognized.
- ESP configuration: Each Email Service Provider (ESP) has specific steps for setting up custom domain authentication. Mailchimp, for instance, requires CNAME and TXT records, while Amazon SES involves domain verification and DKIM setup within its console.
- Subdomain strategy: Segmenting mail streams by subdomains (e.g., marketing.domain.com) allows independent authentication for each, providing better control and visibility over sending practices across multiple services.
Key considerations
- Verify authentication: Always verify that your domain authentication (SPF, DKIM) is correctly configured with each ESP to ensure proper DMARC alignment. This is crucial for your email deliverability, as discussed in our guide on DMARC, SPF, and DKIM.
- Monitor with DMARC: Set up a DMARC record, even with a p=none policy, to gain visibility into where your domain's mail is originating and identify any authentication issues.
- Custom MAIL FROM: For Amazon SES, consider setting up a custom MAIL FROM domain. Without it, DMARC can only align with DKIM, as the envelope from and header from values might not align for SPF.
- Review ESP documentation: Always refer to the official documentation of your ESP (e.g., Mailchimp's domain authentication guide) for the most accurate and up-to-date instructions on setting up domain authentication and achieving your desired signed by display.
What email marketers say
Email marketers often navigate a complex landscape of third-party email services, trying to balance functionality, cost, and deliverability. A common frustration arises when their emails, sent via platforms like Amazon SES or Mailchimp, don't prominently display their own domain in the signed by header. This impacts brand trust and recognition, making it a critical aspect of their email strategy. Marketers frequently find themselves confused by conflicting advice from different service providers, each vying for their business and often attributing the issue to other platforms or the underlying email service itself.
Key opinions
- Inconsistent signing: Mailchimp often shows signed by the user's domain, but Amazon SES and SendGrid may not, leading to confusion.
- Alignment is key: The core issue often revolves around authentication alignment, suggesting that configuration might be incomplete or incorrect.
- Vendor lock-in concerns: Marketers with legacy pricing or specialized feature needs (like RSS feeds) can face golden handcuffs with current ESPs, making switching difficult despite deliverability concerns.
- Desire for assurance: The primary goal is to ensure the best possible chance of inbox placement and to know all humanly possible steps have been taken.
Key considerations
- Comprehensive audit: Consider an expert audit of all third-party email configurations to ensure optimal setup for each service.
- Understand ESP authentication: Invest time in understanding how each ESP handles SPF, DKIM, and DMARC to debug signed by display issues.
- Prioritize deliverability: While features and pricing are important, consistently getting into the inbox should be the ultimate goal, sometimes warranting a shift in strategy. Our article on fixing personal emails going to spam provides further insight.
- Seek unbiased advice: Look for consultants or platforms that offer impartial advice on email deliverability, rather than pushing for a service switch.
Marketer view
A marketer from Email Geeks notes the struggle with realizing the rapid changes and issues in email deliverability, especially when using multiple third-party systems like Amazon SES for transactional emails and Mailchimp for blog posts. They find it confusing that Mailchimp emails show their domain as signed by their domain, while Amazon SES and SendGrid do not. This discrepancy highlights the inconsistencies in how different ESPs handle email authentication and sender identity display.The marketer expresses a desire to understand how to ensure all services are configured correctly to maximize inbox delivery and maintain brand consistency. They mention the challenge of getting reliable information from service providers, who often suggest switching platforms rather than providing specific configuration advice.
Marketer view
A marketer from Email Geeks explains they are trying to implement a system to monitor and manage email configurations across various third-party tools, recognizing the constant changes in the email landscape. They specifically point out the difficulty in understanding how different services like Mailchimp, Amazon SES, and SendGrid work regarding authentication. The signed by discrepancies are a major point of confusion for them.They feel the need for a consultant to audit their entire email setup to ensure all services are optimally configured for deliverability. This suggests a perceived lack of clear guidance from the ESPs themselves on how to achieve consistent domain signing and optimal inbox placement.
What the experts say
Email deliverability experts consistently emphasize the importance of proper email authentication, especially DKIM and DMARC alignment, to ensure that emails sent through third-party services like Amazon SES and Mailchimp appear to be signed by the sender's own domain. They explain that the signed by header is often controlled by DKIM, and its correct configuration is paramount. Experts also advocate for strategic use of subdomains and DMARC policies to gain visibility and control over all email streams, which can mitigate the issue of seeing the ESP's domain in authentication headers.
Key opinions
- Subdomain segmentation: Segmenting mail streams by subdomains, such as marketing.domain.com, allows each stream to have independent authentication, crucial when using multiple services.
- DKIM for signing: Implementing DKIM for each domain and service provider, ensuring it aligns with your mailing domain, is the primary way to remove Sent via [service] indicators and show your own domain.
- DMARC for discovery: Setting up DMARC with a p=none policy is the fastest way to identify all sources sending mail on behalf of your domain.
- Mailchimp's SPF handling: Mailchimp's approach to SPF may not involve direct SPF alignment with the sender's domain, but its DKIM setup generally ensures proper signed by display. Our guide on why you shouldn't add Mailchimp explains this further.
Key considerations
- Align all authentication: Ensure both SPF and DKIM authentication records are correctly set up and align with your sending domain to fully comply with DMARC and display your domain in the signed by field.
- DMARC implementation: Implement DMARC for comprehensive reporting and enforcement. This allows you to monitor authentication results and identify any senders not properly authenticating as your domain. Learn more about authenticating email with your own domain.
- Configure custom MAIL FROM: For services like Amazon SES, configuring a custom MAIL FROM domain is crucial for SPF alignment, as it ensures the envelope from and header from domains match. More on this from Mailbluster on DMARC alignment.
- Regular auditing: Periodically audit your email setup, especially when adding new services or changing configurations, to maintain optimal deliverability and authentication.
Expert view
An expert from Email Geeks suggests that segmenting mail streams by subdomains can be highly beneficial for managing email authentication across various third-party services. By dedicating specific subdomains, such as marketing.domain.com, support.domain.com, or receipt.domain.com, each can have its own independent authentication setup.This method ensures that if one service experiences an issue, it doesn't negatively impact the deliverability or sender reputation of other email streams. It provides granular control and clarity over which service is sending what type of mail, enhancing overall email deliverability and management.
Expert view
An expert from Email Geeks recommends implementing DKIM for each domain and service provider to ensure alignment with the mailing domain, which will remove many of the Sent via [service] options from email headers. This practice directly addresses the core question of how to show signed by your domain.They also suggest that setting up DMARC with a p=none policy is the fastest way to discover all the sources from which a domain's mail originates. This provides essential visibility for proper authentication setup and troubleshooting.
What the documentation says
Official documentation from email service providers and technical guides consistently detail the steps required to properly authenticate your sending domain, which is fundamental to displaying signed by your domain rather than the ESP's. These resources emphasize the critical roles of DKIM, SPF, and DMARC in establishing sender identity and trust. They provide specific DNS record configurations and verification processes unique to each platform, ensuring that the necessary cryptographic signatures align with your domain for proper authentication.
Key findings
- Mailchimp requirements: Mailchimp requires users to add two CNAME records and one TXT record to their domain's DNS for authentication, which permits Mailchimp to display the user's domain information.
- Amazon SES verification: For Amazon SES, users must verify their domain by adding a DNS verification record. They also need to configure DKIM by adding CNAME records provided by SES to their domain's DNS zone.
- DKIM enablement: Documentation explicitly states that DKIM must be enabled for the custom domain within the Amazon SES console settings to ensure messages are signed by the custom domain.
- Custom MAIL FROM impact: Without a custom MAIL FROM domain, DMARC can only align with DKIM, not SPF, because the envelope from and header from values will not match.
Key considerations
- Exact DNS records: It is crucial to enter the exact CNAME and TXT records provided by your ESP into your domain's DNS zone for successful authentication and proper signed by display.
- Verify identity: Ensure that your domain identity is verified in the ESP's console (e.g., Amazon SES) before attempting to send emails with custom domain signing.
- DKIM status: Always confirm that DKIM is actively enabled and shows a verified status within your ESP's dashboard after adding the DNS records.
- DMARC setup: Beyond SPF and DKIM, implementing DMARC is recommended to validate authentication and ensure brand domain alignment, further solidifying the signed by appearance.
Technical article
Documentation from Mailchimp outlines that setting up email domain authentication is a necessary step to ensure that Mailchimp is permitted to display your domain's information, rather than showing via mailchimp.com. This involves adding specific DNS records to your domain's configuration.They explicitly state that this authentication process requires users to add two CNAME records and one TXT record to their domain's DNS records. Completing this ensures that emails sent through Mailchimp are properly authenticated and can proudly display your brand's domain.
Technical article
Documentation from ReplyUp details how to authenticate domains in Amazon SES for sending emails from owned domains. The initial step involves adding your domain to Amazon SES and obtaining the necessary domain verification record and DKIM records.It instructs users to enter these records into their domain's DNS zone before proceeding. This emphasizes that successful authentication for Amazon SES, including ensuring proper signed by display, relies on accurately updating DNS settings with the provided information.
Related resources
10 resources
Related pages
Should I authenticate email with my own domain or an ESP's domain?
How to set up email authentication for multiple ESPs?
How to use DKIM to sign emails with different header from domains?
Can DKIM be set up on a subdomain, and which domain should be used for signing?
A simple guide to DMARC, SPF, and DKIM
Why you shouldn't add Mailchimp to your SPF record
Understanding and troubleshooting DMARC reports from Google and Yahoo
How to fix common DMARC issues in Microsoft 365 and Google Workspace
Why Your Emails Are Going to Spam in 2024 and How to Fix It
Boost email deliverability rates: Technical solutions
