SPF, DKIM and DMARC setup guides

Google Workspace

Mailbox provider

Publish include:_spf.google.com in your root SPF record and the google._domainkey TXT key generated in the Admin console, then click Start authentication. From then on Gmail signs as your domain, so DKIM aligns with your From address.

Microsoft 365

Mailbox provider

Publish include:spf.protection.outlook.com in your root SPF record and two DKIM CNAMEs (selector1 and selector2), then enable DKIM for the domain. Custom domains added since May 2025 use a new CNAME target under dkim.mail.microsoft. SPF and DKIM both align.

Amazon SES

Transactional email API

Verify the domain with the three Easy DKIM CNAMEs that SES generates; DKIM then aligns with your From domain. Your root SPF record needs no change. For SPF alignment, add a custom MAIL FROM subdomain with an MX and an SPF record.

SendGrid

Transactional email API

Authenticate your domain in SendGrid. With automated security (the default) you publish three CNAMEs: em{nnnn} for the return path plus s1 and s2 for DKIM. DKIM aligns with your From domain, and SPF aligns through the em{nnnn} subdomain.

Mailchimp

Marketing email platform

Authenticate the domain under Account & billing > Domains: two DKIM CNAMEs (k2 and k3) and a DMARC record, with the exact values shown on that page. No SPF change is needed. DKIM aligns with your From domain; SPF stays on Mailchimp's own domains.

Mailgun

Transactional email API

Publish v=spf1 include:mailgun.org ~all and the DKIM key Mailgun assigns on your sending domain, ideally a subdomain such as mg.example.com. SPF and DKIM both align with a From address on that domain, or on its parent under relaxed alignment.

Postmark

Transactional email API

Publish the DKIM TXT record Postmark shows for your domain and a pm-bounces CNAME to pm.mtasv.net as a custom Return-Path. No SPF include is needed. DKIM aligns once verified; SPF aligns through the Return-Path under relaxed alignment.

Brevo

Marketing email platform

Authenticate the domain in Brevo: a brevo-code TXT, two DKIM CNAMEs (brevo1 and brevo2) and a DMARC record, with the exact values shown in Brevo's setup screen. DKIM aligns with your From domain; on shared IPs no SPF record is needed.

Zoho Mail

Mailbox provider

Verify the domain, point MX to Zoho, add include:zohomail.com to your root SPF record, then publish the DKIM key from the Zoho Mail Admin Console and enable it. DKIM then aligns. Values here are for the zoho.com data center; others differ.

HubSpot

Marketing automation

Connect your email sending domain in HubSpot: two DKIM CNAMEs (hs1 and hs2), an account-specific SPF include and a DMARC record, all shown in HubSpot's setup screen. DKIM aligns; SPF aligns only with a custom return-path or dedicated IP.

Klaviyo

Marketing email platform

Set up a branded sending domain: verify the root domain with a TXT record, then point a sending subdomain to Klaviyo with NS records (dynamic routing) or CNAMEs (static routing). DKIM aligns with your From domain; no SPF change is needed.

Zendesk

Help desk

Add include:mail.zendesk.com to your root SPF record and two DKIM CNAMEs (zendesk1 and zendesk2), then turn on Custom domain for DKIM. DKIM then aligns with the domain of your support address.

Resend

Transactional email API

Publish the resend._domainkey TXT key and the Return-Path records on send.{domain}: an MX and an SPF record, or two CNAMEs on some domains created after August 2026. Resend shows the exact records per domain. SPF aligns through send.{domain}.

Mailjet

Transactional and marketing email platform

Add include:spf.mailjet.com to your root SPF record and publish the mailjet._domainkey TXT key Mailjet shows for your domain. DKIM aligns with your From domain; SPF aligns only with a custom bnc3 Return-Path, which Mailjet support activates.

Mailchimp Transactional (Mandrill)

Transactional email API

Since March 15, 2024 every Mandrill sending domain needs domain verification, two DKIM CNAMEs (mte1 and mte2) and a DMARC record. DKIM aligns with your From domain; SPF is not part of the current requirements.

Constant Contact

Marketing email platform

Self-authenticate your domain with two DKIM CNAMEs (ctct1 and ctct2) and a DMARC record, which Constant Contact requires to activate it. No SPF change is needed. DKIM aligns with your From domain; SPF never does.

Fastmail

Mailbox provider

Point MX to in1-smtp and in2-smtp.messagingengine.com, add include:spf.messagingengine.com to your root SPF record and publish all three DKIM CNAMEs (fm1, fm2 and fm3). DKIM is what aligns with your From domain.

Proton Mail

Mailbox provider

Verify the domain, point MX to mail.protonmail.ch and mailsec.protonmail.ch, add include:_spf.protonmail.ch to your root SPF record and publish the three DKIM CNAMEs from Proton's setup screen. DKIM aligns once Proton detects them.

SparkPost

Transactional email API

Publish the DKIM TXT key SparkPost generates for your sending domain; that is what aligns for DMARC. No SPF include is needed. For SPF alignment, add a custom bounce domain: a subdomain CNAME to sparkpostmail.com, verified in SparkPost.

MailerSend

Transactional email API

Publish the merged SPF record MailerSend shows, two DKIM CNAMEs (ms1 and ms2) and the mta Return-Path CNAME to mailersend.net. DKIM aligns through ms1 and ms2, SPF through mta.{domain}. TXT-based DKIM stops working on February 1, 2027.

Customer.io

Customer messaging platform

Customer.io sends from an account subdomain, cio{account-number}.{domain}: publish two MX records, an SPF record and a DKIM TXT key there, plus DMARC on your root domain. SPF and DKIM align only under relaxed DMARC alignment.

Intercom

Customer messaging platform

Authenticate your domain in Intercom with two CNAMEs, intercom._domainkey for DKIM and a return-path CNAME for SPF, plus a DMARC record of at least p=none. Intercom shows the exact targets in its setup screen. DKIM and SPF then both align.

iCloud Mail

Mailbox provider

Custom Email Domain needs iCloud+. Publish the personal verification TXT, MX records for mx01 and mx02.mail.icloud.com, include:icloud.com in your root SPF record and the sig1 DKIM CNAME, which puts the DKIM key under your domain.

Salesforce Marketing Cloud

Marketing automation

Authentication needs a Sender Authentication Package (SAP) or Private Domain: delegate a subdomain such as email.mycompany.com to Salesforce with four NS records, and Salesforce hosts its SPF, DKIM and DMARC records. DKIM signs as that domain.