MailWizz DKIM and SPF Authentication — What MailWizz Controls vs What the SMTP Relay Controls

Email authentication in a MailWizz deployment is split between MailWizz and the SMTP relay. Understanding which layer controls each authentication mechanism prevents configuration gaps that cause DMARC failures.

Authentication Responsibility by Layer

• MailWizz controls: From address (DMARC alignment), Reply-To, campaign headers, List-Unsubscribe, tracking domains
• SMTP relay controls (PowerMTA): DKIM signing, SPF envelope sender, PTR records for sending IPs
• DNS controls: SPF TXT records, DKIM selector TXT records, DMARC policy, PTR records

DKIM in MailWizz + PowerMTA Deployments

When MailWizz sends through PowerMTA, DKIM signing is performed by PowerMTA — not by MailWizz. MailWizz passes the message to PowerMTA via SMTP, and PowerMTA's domain block DKIM configuration signs the message before delivery to ISPs. MailWizz does not need any DKIM configuration in this architecture.

Verifying DKIM End-to-End

# Method 1: Send a test campaign to a Gmail account
# In Gmail: View Original → look for:
authentication-results: mx.google.com;
       dkim=pass header.i=@yourdomain.com

# Method 2: Use mail-tester.com
# Send a test message, review the authentication score

SPF Configuration for MailWizz Environments

# SPF must include the IP range of your SMTP relay (PowerMTA server)
# yoursendingdomain.com DNS TXT record:
v=spf1 ip4:203.0.113.0/24 ~all

# Or include a sending domain
v=spf1 include:mail.yourdomain.com ~all

DMARC Alignment Check

DMARC alignment requires the From address domain to match either the SPF-authenticated domain or the DKIM d= domain. If MailWizz sends from campaigns@yoursendingdomain.com but PowerMTA signs with DKIM d=relay-yourdomain.com, DMARC alignment fails regardless of authentication passing individually.

Troubleshooting Common Issues

Production MailWizz deployments encounter predictable issues at predictable stages. Understanding the diagnostic workflow for the most common problems in this configuration area saves time and prevents the escalating complexity that comes from applying fixes to a misdiagnosed problem. The diagnostic approach is always the same: identify the symptom precisely (not just "it's not working"), isolate the layer where the failure occurs (MailWizz application, delivery server connection, DNS, ISP rejection), and fix at the correct layer.

Systematic Diagnosis Approach

Check MailWizz logs first (available in Backend → Misc → Application Logs), then check the delivery server SMTP logs, then check the PowerMTA accounting log. Most issues surface in one of these three places. A problem that does not appear in any of these logs is almost always a configuration issue — the system is not attempting what you expect it to attempt.

# MailWizz diagnostic log locations:
# Application logs: Backend → Misc → Application Logs
# Delivery logs: Backend → Campaigns → [Campaign] → Delivery Logs
# Bounce logs: Backend → Bounce Servers → [Server] → Logs

# Server-side logs:
# MailWizz application: /path/to/mailwizz/apps/common/runtime/application.log
# PowerMTA delivery: /var/log/pmta/pmta.log
# PowerMTA accounting: /var/log/pmta/accounting.csv

Performance Optimization for Production Scale

MailWizz performance at scale depends on three infrastructure layers: the web application server (PHP/nginx or Apache), the database (MySQL — query optimization is critical at high subscriber counts), and the delivery infrastructure (PowerMTA connection pool sizing). Performance problems in any of these layers manifest as slow campaign sends, delayed processing, or timeouts that appear unrelated to the specific configuration area being managed.

The most common performance constraint in production MailWizz environments is MySQL query efficiency. As subscriber lists grow beyond 500,000 records, unoptimized database queries for segmentation, bounce processing configuration, and campaign statistics become significant bottlenecks. Ensure that subscriber tables have appropriate indexes on email, status, date_added, and any custom field columns used for segmentation.

# MySQL optimization for large MailWizz installations
# Check slow query log:
SHOW VARIABLES LIKE 'slow_query_log%';
SET GLOBAL slow_query_log = 'ON';
SET GLOBAL long_query_time = 1;  # Log queries over 1 second

# Key indexes to verify exist:
SHOW INDEX FROM mailwizz_lists_subscribers;
# Should have indexes on: email, status, date_added, list_id

# Add missing index if needed:
ALTER TABLE mailwizz_lists_subscribers 
  ADD INDEX idx_email_status (email, status);
  
# Campaign sends table — index on campaign_id + subscriber_id:
ALTER TABLE mailwizz_campaigns_tracking_opens
  ADD INDEX idx_campaign_sub (campaign_id, subscriber_id);

Security Considerations

MailWizz installations handling production sending volumes are valuable targets. Key security practices: use HTTPS for all MailWizz access (including tracking and unsubscribe links), restrict Backend access to authorized IP ranges via web server configuration, rotate API keys periodically and revoke unused keys, maintain regular database backups (automated, offsite), and ensure PHP and MailWizz are kept current with security patches.

The tracking domain (used for open and click tracking) requires special attention: it must have a valid SSL certificate (Let's Encrypt is acceptable), and its DNS records must point exclusively to your MailWizz server. A compromised tracking domain can redirect recipients to malicious sites or reveal subscriber click data to third parties.

Campaign Analytics Integration

Track this MailWizz configuration area through two complementary metric layers: MailWizz campaign statistics (open rate, click rate, bounce rate, unsubscribe rate) and PowerMTA accounting log data (ISP-specific deferral rate, bounce classification, queue depth). Gaps between the two layers reveal delivery problems invisible to MailWizz statistics alone — high MailWizz "sent" counts with elevated PowerMTA deferral rates indicate a queue buildup that campaign dashboards don't surface.

Review campaign metrics against your own historical baselines rather than industry benchmarks. Your list composition, acquisition source, and engagement history define what normal looks like for your environment. Use rolling 7-day and 30-day averages to distinguish trend changes from campaign-specific variance.

Implementation Checklist

Before deploying this configuration to production MailWizz, verify: delivery server connection test passes in Backend → Servers → Delivery Servers, cron jobs are running on the correct schedule, bounce server mailbox is accessible and IMAP credentials are valid, tracking domain has valid SSL and loads within 500ms, and PHP memory limit is set to at least 256MB.

After deploying, send a test campaign to a controlled list of seed addresses across Gmail, Outlook, and Yahoo. Verify Authentication-Results headers show dkim=pass and spf=pass in the received messages. Check that open and click tracking are registering correctly in MailWizz statistics. Confirm bounce processing is updating subscriber status within 15 minutes of a test bounce event.

For managed MailWizz environments operated by Cloud Server for Email, these verification steps are performed automatically after any configuration change. The managed service includes continuous monitoring of delivery server health, cron job execution, and tracking domain availability. Contact infrastructure@cloudserverforemail.com for information about managed MailWizz hosting.

Authentication Verification After Configuration

After configuring SPF and DKIM in MailWizz, always verify with a live test send to a Gmail account you control. Check the raw message headers for Authentication-Results: dkim=pass and spf=pass. Then verify dmarc=pass — this requires the DKIM signing domain to match the From: address domain. If MailWizz signs with a subdomain key but your From: uses the root domain, DMARC fails despite passing DKIM.

DKIM Key Rotation in MailWizz

MailWizz stores DKIM keys in the database per sending domain. When rotating keys, publish the new public key in DNS under a new selector, update the MailWizz DKIM configuration to use the new selector, wait 48 hours for DNS propagation, then verify the new selector appears in Authentication-Results headers before retiring the old DNS record.