This article introduces the different domains used in Dialog Insight for email delivery, interaction tracking, and landing page hosting. You will learn about the role of each domain and discover the email authentication mechanisms, including SPF, DKIM, and DMARC.
Domains Used for Email
Several domains may be involved in email delivery, depending on their purpose. Some identify the sender to the recipient, while others are used for the technical handling of email delivery. Understanding their roles helps explain how email authentication works.
The sender domain is the domain in the email address displayed in the From field, which is visible to the recipient. For example, for the address info@example.com, the sender domain is example.com.
The From field identifies the sender as presented to the recipient. This domain also plays a central role in email authentication through DMARC.
The Mail-From domain is the domain of the return address used in the SMTP envelope, particularly for handling delivery failure notifications (bounces). This address is generally not visible to recipients in their email client. When the message is delivered, the receiving server generally records this address in the message's Return-Path header.
Difference Between the Sender Domain and the Mail-From Domain The sender domain is the domain of the address displayed in the From field, while the Mail-From domain is the domain of the return address used in the SMTP envelope. These two domains may be the same or different, depending on the email sending configuration.For example, an email may display the address info@example.com in the From field while using bounces@return.example.net as the return address. The respective domains are example.com and return.example.net. This distinction is important for understanding how authentication mechanisms verify emails and establish a relationship between the sender's visible identity and the technical information used to send the message. |
Email Authentication Mechanisms
Email authentication allows email services to verify certain aspects of a message's origin and the sender's identity. Properly configuring these mechanisms helps protect your sender identity and improve email deliverability, although it does not guarantee that your emails will reach the inbox.
Three complementary mechanisms are used: SPF, DKIM, and DMARC. Each plays a distinct role in email verification.
- SPF (Sender Policy Framework) allows the receiving mail server to verify whether the IP address of the server sending the email is authorized to send email on behalf of the Mail-From domain.
- DKIM (DomainKeys Identified Mail) verifies the message's digital signature and the integrity of the content covered by that signature. It involves a signing domain, which may differ from the From and Mail-From domains.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) verifies whether the SPF or DKIM authentication result aligns with the sender domain visible in the From field.
For a message to pass DMARC, at least one of the two mechanisms, SPF or DKIM, must pass authentication and meet the alignment requirements for the From domain.
When setting up your account, if you choose subdomain delegation, our team will configure SPF, DKIM, and DMARC for you.
SPF (Sender Policy Framework) allows the recipient's mail service to verify whether the server sending your email is authorized to send email on behalf of the Mail-From domain. To perform this check, the mail service compares the sending server's IP address against the permissions defined in the SPF record published in that domain's DNS.
The Mail-From address is part of the information exchanged between servers to deliver an email. This information forms the SMTP envelope, which is separate from the message content. The SMTP envelope can be compared to a physical mailing envelope: the return address on the envelope may differ from the sender address shown in the letter inside it. In an email, the latter corresponds to the From field, which is visible to the recipient.
The following diagram illustrates how SPF works: .png)
DKIM (DomainKeys Identified Mail) adds a digital signature to your emails. This signature allows the recipient's mail service to verify that the message was signed by an authorized source for the signing domain and that the parts of the message covered by the signature were not altered during transmission.
This mechanism relies on two complementary keys:
- A private key, held by Dialog Insight, which is used to sign your emails.
- A public key, published in the DNS records for the signing domain, which allows mail services to verify the signature.
When the email is received, the mail service retrieves the public key and uses it to verify the signature. If verification succeeds, the DKIM signature is considered valid.
The following diagram illustrates how DKIM works: 
For more information, visit http://www.dkim.org/
DMARC (Domain-based Message Authentication, Reporting and Conformance) allows the recipient's mail service to verify whether an email meets the authentication and alignment requirements for the sender domain visible in the From field. This mechanism helps protect your domain against spoofing.
For a message to pass DMARC, at least one of the following conditions must be met:
- SPF passes authentication and the domain of the technical return address aligns with the domain of the visible sender address.
- DKIM passes authentication and the signing domain aligns with the domain of the visible sender address.
Alignment means that the domains correspond according to the rules defined in your DMARC configuration. Depending on those rules, the domains may be identical or belong to the same organizational domain.
Do you send 5,000 or more emails per day to personal Gmail accounts? Senders who send 5,000 or more emails per day to personal Gmail accounts must configure SPF, DKIM, and DMARC, among other requirements. A DMARC policy with p=none is acceptable for meeting this requirement. For more information, see https://dmarc.org/resources/deployment-tools/. |
Domains Used for Tracking and Web Content
Other domains complement those used for email delivery and authentication. They are used to customize tracking links included in communications and the web addresses of landing pages hosted in Dialog Insight. Using domains associated with your organization helps maintain consistency with your brand identity and build trust with recipients when they click your links or visit your pages.
Dialog Insight collects statistics on links clicked in your communications and also automatically displays certain forms to your contacts, including unsubscribe forms and options for viewing a message online. The links you include in your communications are replaced with links pointing to the platform's servers.
When a contact clicks a link, they are first directed to Dialog Insight's servers, where the click is recorded, and then redirected to the final destination, such as a page on your website. By default, these links use a domain associated with the platform (for example: app.dialoginsight.com).
However, your contacts may find these links suspicious. Why does a link in a communication direct them to app.dialoginsight.com when they do not recognize this site and are unlikely to associate it with your company? To reassure recipients and reduce potential phishing complaints, it is important to configure a domain that will be used to customize tracking links.
If you used domain delegation, a tracking link domain should already be configured in your account. To view your tracking links, go to the Tracking Links section under Account Management.
By default, this address uses a domain provided by Dialog Insight. You can instead configure a custom subdomain so that your landing page URLs use a domain associated with your organization.
Configuring a custom domain for landing pages is optional. It involves adding and validating the subdomain, as well as configuring the DNS settings and SSL certificate.
For more information, see Using a Custom Domain for Landing Pages.