Sending e-mails from your own address

By default every message JobMojito sends on your behalf leaves from interview@jobmojito.com, or interview@interviewmojito.com with your company name shown as the sender. That covers interview invitations, reminders, result and pre-screening notifications, candidate digests and account e-mails.

Most customers want candidates to see their own address instead: Acme Careers <careers@acme.com>. That address cannot simply be typed into a settings field. JobMojito delivers mail through SendGrid, and SendGrid will only send from an address whose owner has proven they own it. Gmail and Microsoft 365 apply the same rule on the receiving side. The proof is called sender authentication, and there are two ways to give it:

• Domain authentication. Three DNS records on your domain. This is the recommended route, and the only one that keeps candidate mail out of spam long-term.

• Single sender verification. One click in an e-mail. No DNS work, but weaker deliverability and limited to a single address.

This article covers what you can change yourself, what to send us, both authentication routes in full, and how to confirm it worked.

1. What you can change yourself, and what needs us

Set the sender name first. It takes effect within seconds of saving and needs no authentication at all. Leave it empty and the platform falls back to the sender name on each template.

One important detail about the address you choose. JobMojito does not set a separate Reply-To header, so replies go straight back to the sending address. Candidates do reply to invitations, with questions, with rescheduling requests, occasionally with their CV attached. Pick a mailbox somebody actually reads (careers@, jobs@, hr@), never a no-reply@ black hole.

2. How the setup runs

The SendGrid account belongs to JobMojito, so the two sides split as follows. We create the entry inside SendGrid and hand you what it produces. You prove ownership of the address or the domain. We then switch your portal over. Nothing changes for your candidates until that last step.

Typical timing: we send you the records within one working day, DNS changes are usually live within an hour (allow up to 48 hours), and the switch-over on our side is immediate once verification passes.

3. What to send us to start

Write to support@jobmojito.com with:

1. The exact address you want to send from, spelled the way candidates should see it, for example careers@acme.com.

2. The sender name, for example Acme Careers. (Or set it yourself first, section 1.)

3. Which route you want: domain authentication (section 4) or single sender verification (section 5). If you are not sure, say so. Unless you tell us otherwise we prepare domain authentication.

4. Who manages your DNS and their e-mail, so we can send the records straight to them. It helps to name the provider too: Cloudflare, GoDaddy, Route 53, Azure DNS, your hosting company.

5. Your portal address (for example careers.acme.com or acme.jobmojito.com), so we change the right portal. If you run several portals or sub-merchants, list every one that should use the new address.

6. A postal address for the sender: street, city, postcode, country. Anti-spam law requires a physical mailing address on the sender record. SendGrid asks for it and will not create the sender without it. Your registered office is fine.

Already use SendGrid yourself, for your own marketing or ATS mail, on the same domain? Tell us. The records are account-specific, and the standard DKIM record names would collide with the ones you already have. We will authenticate a dedicated subdomain for you instead (see section 4.1).

4. Route A: domain authentication (recommended)

Domain authentication publishes, on your own domain, the cryptographic keys SendGrid uses to sign your JobMojito mail. Receiving servers then see mail that is SPF-aligned and DKIM-signed as your domain, which is what your DMARC policy requires, and what Gmail's and Microsoft's bulk-sender rules require as well. It is the difference between invitations landing in the inbox and landing in Junk.

4.1 Choosing the domain

Give us the domain your from-address lives on, for example acme.com. The from-address must belong to the domain that gets authenticated: authenticate acme.com and you can send as careers@acme.com, but not as careers@acme.co.uk.

Prefer a dedicated subdomain, such as hiring.acme.com sending as careers@hiring.acme.com, when:

• you already authenticate acme.com in your own SendGrid account (otherwise the s1._domainkey and s2._domainkey record names collide),

• your DNS team will not accept new records on the apex domain, or

• you want recruiting mail to build its own sending reputation, separate from your corporate mail.

Nothing about domain authentication touches your existing mail flow. Your MX records, your Microsoft 365 or Google Workspace setup, and your root SPF record all stay exactly as they are. The new records live on a subdomain SendGrid picks (em1234.acme.com) and on DKIM selectors (s1, s2) that no normal mail system uses.

4.2 The records we send you

We create the domain in SendGrid and send you three CNAME records. They look like this, with your own numbers in place of the examples:

The first record is the return path, and it is what makes SPF align with your domain. The two _domainkey records carry the DKIM public keys, in two selectors so keys can be rotated without an outage.

If you asked for branded links as well, so that tracked links in marketing-type mail read links.acme.com rather than sendgrid.net, there are two more CNAMEs of the form url1234 and 1234567, both pointing at sendgrid.net. Branded links are optional, and JobMojito's transactional candidate mail does not use click tracking.

4.3 Adding them at your DNS host

The wording differs per provider, but the shape is always the same: DNS ▸ Records ▸ Add record ▸ type CNAME. Five things go wrong often enough to list:

• Paste the host, not the full name. Nearly every panel appends your domain automatically, so the host field takes em1234. Pasting em1234.acme.com creates em1234.acme.com.acme.com, which verifies as nothing. If your panel shows the full name next to the field as you type, use that to check.

• Cloudflare: set each record to DNS only, the grey cloud rather than the orange one. A proxied record answers with Cloudflare's own data and verification can never pass.

• CNAME, not TXT or URL redirect. No quotation marks around the value. Some panels want a trailing dot on the value (sendgrid.net.), and most add it themselves.

• Clear conflicts first. If a record already exists for the same host, an old SendGrid, Mailchimp or ATS entry on s1._domainkey for instance, the new one cannot be added. Tell us and we will re-issue on a subdomain.

• Leave _dmarc, your MX and your root SPF alone. You do not need to add include:sendgrid.net to your root SPF record. With these records in place, SPF is evaluated on the em1234 subdomain instead.

4.4 Verification

Tell us when the records are in. We press Verify in SendGrid, it resolves the three names and reports pass or fail immediately. If it fails, it names the record that did not resolve, and the cause is nearly always one of the five above. We send you the exact mismatch we see, you fix it, and we verify again. There is no limit on attempts and no cost to a failed one.

Changes are usually visible to SendGrid within 15 to 60 minutes. Some registrars are slower, and the outer limit is 48 hours. Do not delete the records afterwards, because SendGrid re-checks them and mail stops being signed if they disappear.

4.5 DMARC

Domain authentication makes SPF and DKIM align with your domain, which is what a DMARC policy checks. If your domain has no DMARC record at all, ask your DNS team to add one. Gmail and Yahoo have required it of bulk senders since February 2024, and it protects your brand from spoofing:

Start at p=none (monitor only), read the aggregate reports for a few weeks, then move to p=quarantine and p=reject once everything that sends as your domain is authenticated. That tightening is safe for JobMojito mail precisely because domain authentication is in place.

5. Route B: single sender verification

Single sender verification proves that one specific mailbox is yours, by sending it a confirmation link. No DNS, no involvement from your IT team, and usually done inside ten minutes.

How it runs

1. You send us the address, the sender name and the postal address (section 3).

2. We create the sender in SendGrid. SendGrid immediately e-mails that address, with a subject along the lines of Verify Single Sender.

3. Someone with access to the mailbox opens it and clicks the verification button. The address shows as Verified in SendGrid straight away. The link is time-limited, so if it has expired, tell us and we resend it.

4. You confirm to us, and we switch the portal over.

If the mail does not arrive within a few minutes, check the spam folder and any mail-gateway quarantine (Mimecast, Proofpoint, Defender). It is a genuine SendGrid message and safe to release.

Know the trade-off before you choose this route. The mail is still sent under SendGrid's own SPF and DKIM identity, and only the visible From line is yours. So:

• If your domain publishes p=quarantine or p=reject in DMARC, mail from your address will fail DMARC at the receiver and be spam-foldered or rejected. Many corporate domains are already at p=reject.

• Gmail and Microsoft treat unauthenticated bulk mail harshly, so invitation open rates suffer even where mail is technically delivered.

• Public mailbox domains such as @gmail.com, @outlook.com and @yahoo.com are not usable as a sender address in practice, for exactly this reason. Use a company domain.

• It covers that one address only. A second address means another round.

Use single sender verification when you need a custom address today and DNS access is days away, then move to domain authentication when it becomes available. We can switch you over later with no interruption: the records go in, we verify, and the address simply starts being signed properly.

6. Confirming it works

Once we tell you the portal is switched over:

1. Invite yourself as a candidate to any interview, using an address at a big provider (Gmail or Microsoft 365 is the useful test). Remember this creates a candidate record in your portal, so delete it afterwards and it will not sit in your reports.

2. Check the received message. The From line should read your sender name and your address.

3. In Gmail, open ⋮ ▸ Show original. With domain authentication you should see SPF: PASS, DKIM: PASS and DMARC: PASS, with mailed-by showing em1234.acme.com and signed-by showing acme.com. With single sender verification, signed-by stays sendgrid.net. That is expected, and exactly the limitation described in section 5.

4. Reply to the message from the candidate side and confirm the reply reaches the mailbox.

<!-- ═══ SCREENSHOT B: Gmail "Show original" with SPF/DKIM/DMARC PASS ═══ -->

7. Troubleshooting

8. Checklist

• Sender name set in Portal customisation ▸ Branding ▸ Email Sender Name.

• Sending address chosen, and it is a real, monitored mailbox on a company domain.

• Request sent to support@jobmojito.com with address, sender name, DNS contact, portal(s) and postal address.

• Records added at the DNS host, hosts entered without the domain suffix, Cloudflare records set to DNS only.

• Verification confirmed by JobMojito.

  _dmarc record present on your domain (at least p=none).

• Test invitation received, headers checked, reply confirmed, test candidate deleted.