CommuniQueue.
Sign in

Sending

Authenticate your sending domain

CommuniQueue-managed mail is signed with your domain's own DKIM key. Signing only works once you have published a few DNS records, so CommuniQueue refuses a send whose from address it cannot sign rather than putting unsigned mail in front of Gmail and Yahoo.

Why an unverified address is refused

Gmail and Yahoo's bulk sender rules expect every message to carry an aligned DKIM signature and a passing SPF check. Mail that carries neither is filtered into spam or rejected outright, and the damage lands on your domain's reputation rather than ours. So a managed send from an unverified address is refused at the point of sending, with the reason on the send in your reports. Verify the domain, or the single address, and the same send goes through.

Add the domain

A workspace Owner or Admin adds a domain at /workspaces/{workspaceId}/settings/senders. CommuniQueue answers with the records to publish, and rechecks them every hour until they appear. Go to your workspaces to open one and start there.

What each record does

  • Two CNAME records publish your DKIM public keys. Receiving servers fetch the key named in the signature and check that the message was not altered in transit.
  • A third CNAME points the return path at our infrastructure, which is what makes SPF align with the domain in your from address rather than with ours.
  • Every record is issued for your domain specifically. Copy the host and value exactly, and do not add your domain a second time if your DNS provider appends it for you.

DNS changes are usually visible within minutes and occasionally take a few hours. You can press Check DNS yourself instead of waiting for the hourly recheck. A verification request that is never completed expires after seven days; add the domain again to get a fresh set of records.

Add a DMARC policy

DMARC tells receiving servers what to do when a message fails both checks, and it is what turns DKIM and SPF into a defence against someone spoofing your domain. Start at p=none, which asks for reports and changes nothing about delivery: 

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

Read the reports for a few weeks, confirm that every legitimate source of mail on the domain is passing, and only then tighten to p=quarantine and eventually p=reject. Publishing a reject policy on day one silently discards mail from systems you have not finished authenticating yet.

If you cannot change DNS

Verify a single sender instead. You give one address, its owner clicks a link in a verification email, and that exact address can send. It is the narrower option on purpose: a verified domain covers every address on it, while a single sender covers one. Your plan counts the two allowances separately.

Domains are authenticated once per account

The first workspace to verify a domain publishes the DNS. Your other workspaces can then send from the same domain with no second setup, because they share the authentication that already exists. If the domain is already claimed by a different CommuniQueue account, verification is refused; contact support if the domain is yours.

Bringing your own provider

None of this applies to a workspace that sends through its own provider. That provider signs the mail, so authenticate the domain in its dashboard instead. CommuniQueue does not check the from address on those sends.