Skip to main content

Custom authentication & secure click tracking links

Custom authentication domains​

Setting up a custom authentication subdomain removes all DNS references to the MessageGears service, so that messages appear to originate from your company’s domain. This is beneficial for consistent branding of your emails, as well as for inbox placement and email authentication.

Once you've set up the custom subdomain, that domain will be used in the return-path headers for each message you send, providing SPF authentication for your messages and allowing us to process bounces on your behalf. The same subdomain will be also used for DKIM signing, to provide an additional layer of message authentication.

Default vs. dynamic signing domains​

MessageGears offers two types of authentication domain setup: Default (often called simply 'Custom') and Dynamic. Default/Custom Domains are assigned to specific accounts, and by default all mail sent from the assigned account(s) is signed with that domain. This is the standard setup if each account will be sending from only one domain.

If the same domain(s) will be used across multiple accounts within your Customer Org, Dynamic domains are the way to go. These are assigned at the Org level, and are automatically applied whenever mail is sent using a specified From domain from any account in that Org.

Each account must have a Default authentication domain assigned, but a dynamic signing domain will override the Default if the From domain matches the dynamic domain's setup.

Subdomain delegation​

To provide a fully white-labeled infrastructure for your mail sent through MessageGears, we recommend subdomain delegation. This process involves selecting an unused subdomain of your desired sending domain (for example, mg.clientdomain.com) to be delegated, or assigned, to MessageGears. By entering new name server (NS) values for that subdomain, you’ll grant our team access to enter the additional records necessary to set up custom authentication and a secure click tracking domain redirect.

The process is simple and straightforward:

  1. Choose your desired subdomain. We typically recommend mg.[yourdomain] if that’s not already in use, but you can choose any currently-unused subdomain.
  2. Contact Support to request the new authentication subdomain setup. In this request, please be sure to include the following:
    • Your Customer Org Name / ID
    • The subdomain you chose to delegate to MessageGears
    • (for a Custom/Default signing domain) The account ID(s) to which it should be assigned
    • (for a Dynamic signing domain) The From domain you'd like associated with this authentication domain
  3. Our team will generate a set of 4 NS values for you to enter in your domain’s DNS console.
  4. Once we receive confirmation the values have been entered, we’ll confirm their accuracy and begin the internal setup for your custom signing and tracking domains.
  5. When setup is complete, we’ll test the domain(s) and then assign to your org.

Why delegation?​

MessageGears has recently moved our custom authentication process from one that required multiple DNS entries -- including a long and often problematic DKIM key -- to a subdomain delegation process that requires only NS values to be entered. This allows the MessageGears Deliverability team to ensure the correct records are in place without additional work from our customers. This also allows us to make direct and timely updates to SPF or DKIM records if our sending infrastructure changes, while also providing more flexibility to rotate DKIM keys for greater security.

Secure click tracking​

Custom click tracking allows you to change the domain of the click tracking URL in your email content. Click tracking URLs are redirects which route the clicker briefly through MessageGears before landing on the target page, allowing MessageGears to identify a unique click and the recipient who made it.

Setting up a custom tracking domain means the links in your email content will be white-labeled with your website's URL, helping reinforce the legitimacy of the links and ensuring consistent branding across your email content.

If you have delegated a subdomain to MessageGears for custom authentication, no additional work is necessary from you. Our team will create a new subdomain for the secure click tracking -- typically adding trk. to the beginning of your custom subdomain. For example, if you chose mg.[yourdomain] for the signing domain, your new tracking domain will be https://trk.mg.[yourdomain].