CodeTwo Email Authentication Guide: SPF, DKIM, And DMARC

Key Takeaways

Securing your CodeTwo messages with SPF, DKIM, and DMARC is essential for domain protection and reliable inbox placement.
Update your existing SPF record with the appropriate CodeTwo regional address if you rely on their Cloud or Combo mode.
Configure DKIM directly through your Microsoft 365 Defender portal since CodeTwo uses Exchange Online for email signing.
Begin your DMARC journey with a p=none policy to safely observe your mail flow and catch setup errors before enforcing stricter rules.
Always validate your updated DNS records using a specialized domain health tool.
After stabilizing your authentication, upgrade to DMARC enforcement and look into advanced standards like BIMI and MTA-STS.

When your company relies on CodeTwo Email Signatures 365 to standardize corporate email footers, getting your domain authentication right is a top priority. Because the platform routes your messages through its own Azure environment to append signatures, you have to configure SPF, DKIM, and DMARC correctly. These three protocols collaborate to block spoofing attempts and signal to major providers like Google and Yahoo that your messages are legitimate and belong in the inbox.

Why Authenticate Your Domain for CodeTwo?

CodeTwo is a powerful platform for centrally managing branding and legal disclaimers across your Microsoft 365 environment.

Implementing authentication protocols for this service yields several immediate advantages for your organization:

Enhanced Security: Defends your domain name against phishing and spoofing attacks.
Better Inbox Placement: Proves to receiving mail servers that your emails are trustworthy, which drastically reduces the chances of them landing in the spam folder.
Improved Sender Trust: Builds a solid sender reputation across the global email ecosystem.
Clear Traffic Insights: Provides detailed visibility into all the servers and services sending messages on your behalf.

Steps to Configure CodeTwo SPF and DKIM

Source: CodeTwo Admin Panel

To configure the SPF TXT record, you will need administrative access to your domain’s DNS settings and your Microsoft 365 Defender portal to get started.

Step 1: Check Your CodeTwo Routing Mode

Before touching your DNS, confirm how CodeTwo is deployed in your environment. If you only operate in Outlook (client-side) mode, your outgoing messages do not pass through external servers. In that case, you can skip the SPF update.

However, if your setup uses Cloud or Combo mode, updating your SPF record is mandatory. You will also need to identify your Microsoft 365 tenant region to pick the correct server address.

Step 2: Update Your SPF Record

Open the DNS management console for your domain provider (such as GoDaddy, Cloudflare, or Route 53). You likely already have an active SPF record for Microsoft 365.

You must never create a second SPF record because multiple records will break your email authentication. Just edit your current record by inserting the right CodeTwo server address before the ~all or -all mechanism.

Select the include statement that matches your region:

United States: include:spf-us.emailsignatures365.com
Europe: include:spf-eu.emailsignatures365.com
United Kingdom: include:spf-uk.emailsignatures365.com
Canada: include:spf-ca.emailsignatures365.com
Australia: include:spf-au.emailsignatures365.com
Germany: include:spf-de.emailsignatures365.com

Example: For a US-based tenant using Microsoft 365, the modified TXT record will look like this:

v=spf1 include:spf.protection.outlook.com include:spf-us.emailsignatures365.com ~all

If your domain uses many third-party tools and you are approaching the DNS lookup limit, consider utilizing a Hosted SPF service. You can also review your existing setup using PowerDMARC’s SPF checker.

Step 3: Turn on DKIM in Microsoft 365

CodeTwo operates differently from many external sending platforms because it does not require you to generate custom DKIM keys in its portal. The service sends emails from your tenant to CodeTwo servers, adds the signature, and routes them back to your tenant. Because of this round trip, Exchange Online handles the final DKIM signing.

You simply need to ensure the feature is active in your Microsoft environment.

Log in to the Microsoft Defender portal at security.microsoft.com.
Navigate to Email & collaboration > Policies & rules > Threat policies > Email authentication settings.
Click on DKIM and select your sending domain.
Switch the toggle to turn on DKIM. Microsoft will then provide two CNAME records (typically selector1 and selector2).
Copy these CNAME records and publish them in your DNS provider’s console.
Go back to the Defender portal to finalize the setup.

Check if your keys are active by using PowerDMARC’s DKIM checker.

Steps to Configure Your DMARC Record

With SPF and DKIM in place, you are ready to configure DMARC. This protocol relies on the alignment of either SPF or DKIM to verify an email’s authenticity. Rather than guessing the correct syntax, you can easily build a fully compliant record with PowerDMARC’s free DMARC Record Generator.

Open the Free DMARC Record Generator tool.
Choose p=none (monitor-only mode) for your policy. This is a safe starting point that prevents mail from being blocked while you analyze your traffic for errors.

Here is a quick breakdown of the available policies:

p=none (Monitor): Allows normal mail delivery while generating valuable reports on your domain’s sending activity.
p=quarantine (Soft Enforcement): Sends emails that fail authentication directly to the recipient’s spam folder.
p=reject (Strict Enforcement): Outright rejects failing emails so they never reach the recipient.

Important: Do not jump straight to an enforcement policy. Doing so could block legitimate business communications. A monitoring policy helps you fix underlying issues safely.

1. Enter a dedicated email address in the Reporting field so you can receive your aggregate (rua) reports.

2. Access your DNS settings and create a new record:

Type: TXT
Host/Name: _dmarc (or _dmarc.yourdomain.com)
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save your new TXT record.

Verify Your Setup

Step 1: Check Microsoft 365

Keep in mind that DNS changes can take up to 24 hours to fully propagate. After saving your records, revisit the Microsoft Defender portal to verify that your DKIM keys are successfully signing messages. Sending an internal test email and reviewing the headers is a great way to confirm the DKIM signature is passing.

Step 2: Run a Domain Health Check

To be absolutely certain everything is working, validate your published records using PowerDMARC’s free DMARC Record Checker.

A successful check will display:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

If your overall score is a bit low, it usually means you still need to implement advanced protections like BIMI or MTA-STS.

Final Words

Ready to maximize your email security? The PowerDMARC team can help you confidently transition to DMARC enforcement, display your brand logo in customer inboxes with BIMI, and simplify your report monitoring.

Reach out to our team or book a PowerDMARC demo today to secure your business communications!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

CodeTwo DKIM, DMARC, and SPF Setup Guide