For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Email security for account domains

Signicat account domains host web endpoints for services such as authentication and signing. They are not email-sending domains and must not be used in email sender addresses.

This applies to both standard Signicat domains and custom domains that point to Signicat with a CNAME record. For example:

login.example.com. CNAME <account-id>.app.signicat.com.

Signicat no-mail policy​

Signicat publishes the following no-mail records for its account-domain targets:

<account-id>.app.signicat.com. MX  0 .
<account-id>.app.signicat.com. TXT "v=spf1 -all"

These records have the following effects:

  • The null MX record (MX 0 .) indicates that the domain does not accept incoming email.
  • The SPF -all policy indicates that no mail server is authorised to send email using the domain as the envelope sender.

DNS queries for MX and TXT (SPF) records on a custom account domain follow its CNAME to the Signicat target, where these records are published.

The policy covers Signicat account-domain targets in sandbox and production, including the no-CAA and X.509 variants.

Covered Signicat namespaces
  • *.app.signicat.com
  • *.sandbox.signicat.com
  • *.no-caa.signicat.com
  • *.app-x509.signicat.com
  • *.sandbox-x509.signicat.com
  • *.no-caa-x509.signicat.com

DMARC​

DMARC is looked up at a separate DNS name. For example, the DMARC record for login.example.com is queried at _dmarc.login.example.com. This name does not follow the CNAME for login.example.com, so Signicat cannot publish the record on your behalf.

To complete a no-mail policy for a custom account domain, you can publish:

_dmarc.login.example.com. TXT "v=DMARC1; p=reject; adkim=s; aspf=s"

The adkim=s and aspf=s settings require strict alignment. This prevents email authenticated for a parent domain such as example.com from aligning with the web-only login.example.com domain. Also remove any existing DKIM configuration as described below.

An applicable policy on a parent domain can also cover the custom account domain, but a policy that uses relaxed alignment does not provide the same hard no-mail guarantee. Coordinate changes to parent-domain DMARC policies with your email administrator because they can affect legitimate email from other subdomains.

For details about how a DMARC policy is selected, see DMARC policy discovery.

DKIM​

DKIM keys are not required for an account domain that does not send email. Before treating a custom account domain as a no-mail domain, remove all of its DKIM selector records and disable or revoke the corresponding signing keys in any email service that previously used the domain.

If a sender retains an active key and its selector record, it can sign with the custom account domain as the DKIM d= domain. That signature is strictly aligned and can pass DMARC even though SPF is set to -all.

With SPF -all, an applicable DMARC p=reject policy that requires strict SPF and DKIM alignment, and no possibility of a valid aligned DKIM signature, messages claiming to originate from the account domain cannot obtain an aligned SPF or DKIM pass and therefore fail DMARC. The absence of DKIM keys is expected for this no-mail configuration.

Some email-security scanners recognise the no-mail configuration and skip their DKIM check. Others might still display a missing-DKIM warning. Scanner results vary and such a warning does not indicate reduced security for the Signicat web service.

For more information, see the M3AAWG best practices for protecting non-sending domains.

Email sent by Signicat services​

Signicat-generated email uses dedicated email domains instead of your account domain. If you want Signicat services to send email from a domain that you own, configure a separate custom email domain.

On this page