Sender validation and email authentication

Before you can send email campaigns with Flexmail, you need to sort out two things: validating your sender address and setting up email authentication. Think of it as a two-step trust system.

Sender validation proves to Flexmail that you have permission to send from a specific email address. Email authentication then proves to the receiving mail servers (such as Gmail, Outlook and Yahoo) that your emails genuinely come from you and have not been altered along the way.

Together, these steps ensure that your campaigns land in the inbox instead of the spam folder, and they protect your brand against abuse.

This article guides you through both steps.

Before you start

Make sure you have the following at hand:

• For sender validation: access to the inbox of the email address you want to validate. Someone will need to open a confirmation email and click a link.
• For email authentication: access to the DNS settings of your domain, or the contact details of someone who does (your domain administrator, webmaster, IT department or hosting provider).

Do not worry if you are not sure what DNS settings are. We explain everything step by step, and Flexmail generates a ready-made report that you can simply forward to the right person.

Part 1: Validating a new sender address

Sender validation ensures that the owner of an email address has given permission to use it as a sender in your Flexmail account. You only need to do this once per email address.

Step-by-step

1. Go to Settings > Add or remove senders in your account.

   

2. Click the Add a new sender button.

   

   If you already have a sender address that has not been validated yet, you will see a Resend approval email button next to it. Click it to request a new confirmation email.

   

   
   

3. A pop-up appears. Enter the email address you want to use as a sender and click Request approval.

   

4. A confirmation email is sent to the email address you entered. The owner of that email address must open the email and click Verify my email address to give permission.

   

   This is an important step. Flexmail sends the confirmation to the actual inbox of that address, so someone must be able to receive and read that email.

5. Once the address has been verified, a checkmark appears next to it. You can now use this email address to create and send campaigns.

6. Click the star icon next to an email address to set it as default. This address is then automatically pre-selected when you create a new campaign. To remove a sender address you no longer need, click the Remove sender button to the right of it and confirm the deletion.

   

   
   

Part 2: Setting up email authentication

Now that your sender address is validated, Flexmail knows that you may send from that address. However, the receiving mail servers (Gmail, Outlook, Yahoo and others) do not know that yet. Email authentication is the step that tells them your emails can be trusted.

Authentication involves adding a few DNS records to your domain. Flexmail generates these records for you, so you do not need to figure them out yourself. In most cases, you simply forward a file to the person who manages your domain.

What are SPF, DKIM and DMARC?

You see three types of records in the authentication settings. Here is what they do in simple terms:

• SPF (Sender Policy Framework) tells receiving mail servers which servers may send email on behalf of your domain. Think of it as a guest list for your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send, so the recipient can check that the message was not modified on the way. Think of it as a sealed envelope.
• DMARC (Domain-based Message Authentication Reporting and Conformance) links SPF and DKIM together and tells mail servers what to do if a check fails: accept, quarantine or reject the message.

Step-by-step

1. Go to Settings > Add or remove senders in your account.

   

2. Your sender addresses are grouped by domain. Click the Set up authentication button next to the domain you want to authenticate.

   

3. A pop-up opens with the DNS records required. Each record has a background colour as an indicator:
   • Green means the record is already active. No action needed.

   • Red means the record is not active yet. This can mean it still needs to be added to your domain's DNS, or, in the case of DKIM, that the key has not been installed on Flexmail's side yet (see step 5).

     

4. The SPF and DMARC records are generated automatically by Flexmail. You do not need to do anything to create them. They only need to be added to the DNS by your domain administrator.

5. The DKIM key must first be generated before it can be added. You see a selector field with a default value of "flexmail".

   The selector is simply a label that helps identify which DKIM key was used to sign an email. For most users, this default value works fine and you would basically only change it if your domain administrator specifically requests it.

   Click Generate DKIM keys to create the key

   

6. Click Generate report at the bottom of the pop-up. A TXT file downloads automatically. This file contains all the DNS records that your domain administrator needs to add.

   

7. Forward this file to your domain administrator, webmaster, IT department or hosting provider with a short message, for example: "Could you add these DNS records to our domain? They are needed to authenticate our email campaigns in Flexmail." The person who manages your DNS knows what to do with the file.

Setting up, changing and removing a return-path

What is a return-path?

A return-path (also called a bounce address) is the address where mail servers send an error message when an email cannot be delivered (a bounce). By default, Flexmail uses a shared address for this that does not come from your own domain.

For DMARC alignment, the return path must come from the same domain as your sender address. Setting up your own return-path ensures this, improving the deliverability of your campaigns and helping mail servers recognise your messages as trustworthy.

You can also set up a return-path via the API.

Setting up a return-path (first time)

1. Go to Settings > Add or remove senders.

   

2. Next to your domain, click "Set up authentication".

   

3. Scroll in the panel to the "Return-path" section. If no return-path has been set up yet, you see an input field for the prefix (filled in with "bounce" by default) followed by your domain name, for example bounce.flexmail.be   .

   

4. Do you want a different prefix than "bounce"? Adjust it in the field.

5. Click "Set up return-path". Flexmail then displays the CNAME record that you must publish: a record name (your return-path domain) and a record value with a copy button.

   

6. Add this record in the DNS settings of your domain, or pass it on to whoever manages this for you.

Changing a return path

Have you already set up a return path? Then the panel shows the current CNAME record and its status.

1. Click "Change prefix" and adjust the prefix in the field.

   

2. Click “Save return-path” to replace your existing return-path with the new one and display the new CNAME record to publish.
3. Add the new record in the DNS settings of your domain, or pass it on to whoever manages this for you.

If you enter the same prefix again as your current return path or click Cancel, nothing changes.

Removing a return path

You can remove your return path, for example when you phase out a sending domain or want to return to Flexmail's default return path.

1. In the "Return-path" section, click "Remove return-path".

2. You receive a confirmation prompt with a warning: transactional emails for this domain are rejected until a validated return path exists again, and marketing emails fall back to Flexmail's default (non-aligned) return path.

   

3. If you confirm this, the return path is removed. You can set up a new one at any time afterwards.

Checking whether authentication is active

Come back to Settings > Add or remove senders after 24 to 48 hours and click Set up authentication again for your domain. If all boxes have turned green, your authentication is active and everything is working properly.

If any indicators are still red after 48 hours, check the following:

• If the DKIM indicator is red but the badge "authentication keys added correctly" next to the domain in the overview is green, do not worry. This means the DNS records are fine, but the installation on Flexmail's servers is still being processed. This should resolve itself.
• If the badge is red, the DNS records have not been detected yet. Check with your domain administrator whether the records were added correctly. You can regenerate the report and compare it with what is currently in the DNS.

Need help with DNS?

Combell customers

Good news! Here you will find all instructions to set up authentication in your Combell control panel.

Not succeeding or afraid of doing something wrong? Send your generated report to support@combell.com. They know exactly what to do.

Other hosting providers

If you are hosted elsewhere, your hosting provider's support team can help. Most providers (such as OVH, Cloudflare, TransIP, one.com, etc.) have documentation on how to add TXT records. In many cases, you can also simply forward the generated report to their support team with the request to add the records for you.

Frequently asked questions

Do I need to set up authentication for each sender address?

No. Authentication is set up per domain, not per email address. If you authenticate the domain example.com, all sender addresses ending in @example.com are covered.

I added the records, but the indicators are still red.

DNS changes can take up to 24 to 48 hours to take effect. This is completely normal. Check again after a day or two.

I cannot validate my sender address because no one receives the confirmation email.

Make sure the email address has an accessible inbox. Addresses like no-reply@example.com       often do not have a mailbox, making validation impossible. Use an address that someone can actually open, such as info@       or marketing@      .

What happens if I skip authentication?

Flexmail does not block sending if you have fewer than 5,000 contacts, but your emails can end up in spam or be rejected completely by providers like Gmail and Yahoo. We strongly recommend setting up authentication from the start.

Next steps

Your sender is validated and your domain is authenticated. You are completely ready to start creating campaigns. Here are a few logical next steps:

• Create an email campaign - start building your first message.
• Determine your sender details once and for all - set up a naming convention for your sender addresses and names.
• Get started with Flexmail - a broader overview of how to get going.