Platform
Sender addresses
Sign-in links and one-time codes are the only email your users receive from Authalla, and they arrive at the moment a user is deciding whether to trust you. Sending them from your own address means they look like you and land in the inbox more often.
Sender addresses are included in every plan.
How it works
You add the address mail should come from, such as hi@example.com, publish a few DNS records for its domain, and verify. Then you choose it for each tenant that should send from it. No email is sent to the address during setup: the DNS records are the proof that the domain is yours.
The emails come from your tenant's product name at that address, for example Acme <hi@example.com>. Until a tenant sends from an address of yours, they come from Authalla's sign-in address, noreply@authalla-mail.com.
Delivery itself runs through our email provider — see Data residency for what that means for your users' addresses.
Add a sender address
- Go to Tenants → (select tenant) → Email.
- Click Add sender address and enter the address, for example
hi@example.com. - Copy the DNS records shown.
You will be given these records:
| Name | Type | Purpose |
|---|---|---|
_authalla | TXT | Proves the domain is yours. Its value is unique to your account |
@ | TXT | Lets our email provider send from the domain |
mail._domainkey, or brevo1._domainkey and brevo2._domainkey | TXT, or CNAME | DKIM: signs your outgoing mail so receiving servers can verify it really came from you. You get either one TXT record or two CNAME records |
_dmarc | TXT | DMARC: tells receiving servers what to do with mail that fails those checks. A DMARC policy you have already counts |
Names are relative to the domain: _authalla on example.com is _authalla.example.com, and @ is example.com itself.
Add them at your DNS provider exactly as shown. If your provider imports zone files, as Cloudflare and Amazon Route 53 do, Copy as zone file copies the records you still need in that form, with full names, ready to paste or import. Then click Check DNS records. Authalla looks each record up and shows whether it was found. DNS propagation is usually minutes but can take a few hours; you can check as often as you like. Once all of them are found and our email provider has seen them too, the address is verified.
Send from it
A tenant's Email tab lists where its sign-in emails can come from: Authalla's sign-in address first, then your account's addresses. The one selected is the one the tenant sends from; select another to switch, and the change saves at once.
When an address is verified, the dashboard asks whether the tenant should send from it. Choose Not now to keep the current address; you can select it later. A tenant only sends from a verified address, so an address waiting for its DNS records can't be selected yet, and adding one never changes where a tenant's emails come from on its own.
Several tenants, one address
Sender addresses belong to your account, and every tenant in it can send from them. Staging and production can both send from hi@example.com, each under its own product name. The Email tab of any tenant lists your account's addresses and which other tenants use each.
Every address on one domain shares its DNS records, so a second address on a verified domain, such as support@example.com next to hi@example.com, is verified as soon as you add it.
If another Authalla account has already verified the domain, you can't add an address on it. A domain that was never verified isn't held: if someone else added an address on your domain but never published its records, adding yours replaces theirs.
Remove a sender address
Remove, the bin icon on the address's row, deletes it from your account and from our email provider. The tenants that sent from it go back to Authalla's sign-in address, and the dashboard names them before you confirm. If our email provider can't be reached, nothing is removed, and you can try again. Removing the last address on a domain removes the domain too, so adding an address on it later means publishing its DNS records again.
Setting this up with an agent
The MCP server covers this end to end, so you can describe it rather than click it:
add_sender_address— add an address and get the DNS records backverify_sender_address— check the records have propagatedset_tenant_sender_address— choose the address a tenant sends fromlist_sender_addresses,get_sender_address,remove_sender_address
The Management API has the same operations under /management/v1/sender-addresses, and /management/v1/tenants/{tenant_id}/sender-address for the address a tenant sends from. Sender addresses belong to the whole account, so only an account-wide API key can add, check or remove them.
Troubleshooting
A record stays "Not found yet". Check it with dig TXT _authalla.example.com rather than your provider's UI — some providers append the zone name to a record you have already entered fully qualified, which produces a subtly wrong hostname such as _authalla.example.com.example.com.
Every record is found, but the address isn't verified. Our email provider checks DNS on its own, a few minutes behind. Check again shortly.
Mail sends but lands in spam. DKIM and DMARC only tell the receiving server that the mail is genuinely from you. Reputation is separate and takes time on a new sending domain.
Nothing arrives from your address. Check that the tenant sends from it: its Email tab says where its sign-in emails come from. A verified address that no tenant has chosen changes nothing.