Attendance On Demand Email Authentication Guide: SPF, DKIM, And DMARC Setup

Key Takeaways

Properly configuring SPF, DKIM, and DMARC ensures that automated reports, shift schedules, and employee alerts sent from Attendance on Demand reach the inbox rather than the spam folder.
Attendance on Demand does not publish a universal SPF include or DKIM selector in its public documentation. You must contact your partner or support representative to get tenant-specific DNS values.
Never publish more than one SPF TXT record on your domain. Always merge the provided vendor mechanism into your existing record.
DKIM often serves as the primary path to DMARC alignment for this platform.
Ensure you obtain a custom DKIM selector to cryptographically sign your outbound notifications.
DMARC should be rolled out in phases. Start with a p=none (monitoring) policy for at least two business cycles to capture infrequent emails (like monthly payroll reports) before moving to strict enforcement.

When your organization relies on Attendance on Demand to distribute automated messages (such as time tracking alerts, exception notifications, or schedules) using your corporate domain (e.g., [email protected]), those emails originate from the vendor’s infrastructure, not your internal mail servers.

Without cryptographic DNS authorization, receiving inbox providers will likely flag this behavior as domain spoofing. Implementing SPF, DKIM, and DMARC bridges this trust gap, significantly lowering bounce rates and protecting your brand identity.

(Note: If your automated messages are sent using the default vendor address, such as [email protected], the vendor inherently manages the authentication. The steps below only apply if you wish to use a custom “From” address aligned with your own domain).

Step 1: Request Your Custom DNS Values

Public developer documentation for Attendance on Demand focuses entirely on web services and APIs, not email authentication. Because the platform provisions unique identifiers for each customer, you cannot use generic setup instructions or copy records from another tenant.

1. Open a Support Request: Reach out to your Attendance on Demand channel partner or support contact. Request that “custom-domain sending” be activated for your tenant.

2. Request the Explicit DNS Values: Ask for all necessary authentication parameters:

For SPF: The exact Return-Path (envelope-from) hostname/target, or the specific include: statement generated for your tenant.
For DKIM: The DKIM Selector name, the expected signing domain (d= value), the DNS record type (CNAME or TXT), and the target/public key.

3. Hold Off on DNS Changes: Wait until you receive these exact values. Guessing authentication mechanisms or publishing unauthorized records adds security risks and will cause DMARC failures.

Step 2: Configure Attendance on Demand SPF

SPF validates the infrastructure permitted to send mail on your behalf. To pass DMARC via SPF, the domain in the hidden “Return-Path” header must align with your visible “From” address.

Warning: Attendance on Demand publishes a list of IP addresses online for firewall configurations (HTTP/HTTPS/SMTP). Do not use these IP ranges to build your own SPF record. Outbound mail may utilize entirely different routing. Only use the specific SPF mechanism provided by your support partner.

Option A: Using a Return-Path Subdomain (Preferred)

If your partner provisions a dedicated subdomain to handle the Return-Path (e.g., notify.yourdomain.com), publish the CNAME or TXT record exactly as instructed. This isolates the authentication routing without interfering with your standard corporate email.
(Structural example only; replace placeholders with your issued values):

Type: CNAME
Host: notify (or the delegated subdomain)
Value: <return-path-target-from-aod>

Option B: Merging an Include Statement

If your partner issues a specific include: mechanism for your root domain, you must fold it into your existing SPF record. Never create multiple SPF records.

Before:

v=spf1 include:spf.protection.outlook.com ~all

After (Example):

v=spf1 include:spf.protection.outlook.com include: ~all

Pro Tip: Keep an eye on your SPF 10-lookup limit. If adding this vendor pushes you over the limit, consider utilizing PowerDMARC’s Hosted SPF to automatically flatten your records. You can also check your current setup with PowerDMARC’s SPF checker.

Step 3: Configure Custom DKIM

DKIM is often the most critical authentication layer for Attendance on Demand, especially if custom Return-Path routing is unavailable for certain types of automated alerts. It applies a cryptographic signature that verifies the email content has not been tampered with.

(Structural example only; replace placeholders with your issued values):

Type: CNAME (or TXT)
Host Record / Name: <selector-provided>._domainkey
Value: <tenant-dkim-target-from-aod>

Crucial Next Step: Publishing the DNS record does not immediately start the signing process. You must contact your Attendance on Demand partner to activate DKIM signing on their end. Furthermore, you must trigger a brand new message to test it; previously sent emails cannot retroactively acquire the new signature. Then you can see if your keys are already active by using PowerDMARC’s DKIM checker.

Step 4: Configure Your DMARC Record

DMARC dictates how receiving servers should handle messages that fail authentication. For DMARC to pass, a message must have at least one aligned pass, meaning either SPF or DKIM must pass authentication using a domain that matches your visible “From” address.
Use PowerDMARC’s free DMARC Record Generator to safely build your policy.

1. Access your DNS settings and create a new record.

2. Start in monitor-only mode to gain visibility without blocking legitimate mail:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save your new TXT record.

Step 5: Verify, Troubleshoot, and Enforce

To confirm your configuration is actively protecting your traffic, you must generate a live test.

Triggering a Test Message

Depending on your permissions, you may need your channel partner to execute this. If you have administrative access, navigate to Global Setup > Processes, create or select an Email Reports process, and execute an operator report (e.g., setting up a schedule to “Run Now” delivering to an inbox you control).

Analyzing the Headers

Once you receive the test message, view the raw email headers manually or using our free Email Header Analyzer tool for instant human-readable insights.

Check SPF: Look for spf=pass. Verify that the smtp.mailfrom (Return-Path) domain aligns with your visible From address.
Check DKIM: Look for dkim=pass. Verify that the d= (signing domain) tag matches your organizational domain.
Check DMARC: Look for dmarc=pass in the Authentication-Results header. To troubleshoot errors in your DMARC record, use PowerDMARC’s free DMARC Record Checker for detailed error insights.

If the test fails: When escalating an issue to your partner, do not simply state that “DMARC failed.” Provide them with the full raw email headers, the UTC send time, the recipient address, and the exact failing Authentication-Results line so they can pinpoint the routing issue.

Moving to Enforcement (p=reject)

Do not rush to a p=reject policy. We highly recommend remaining at p=none for at least two full business cycles. This waiting period ensures that infrequent, automated messages, such as end-of-month payroll summaries or quarterly system alerts, have time to trigger, allowing you to verify their authentication status in your aggregate reports before you enforce strict blocking rules.

Final Words

Ready to maximize your email security? The PowerDMARC team can help you confidently monitor your Attendance on Demand traffic via detailed XML aggregate reports, transition safely through the stages of DMARC enforcement, and simplify your domain security.

Reach out to our team or book a PowerDMARC demo today to secure your business communications!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Attendance on Demand Email Authentication Guide: SPF, DKIM, and DMARC