iCloud Mail SPF, DKIM and DMARC setup

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your iCloud Mail account: copy it from iCloud Mail's setup screen, which shows the exact record.

For	Type	Host	Value
Domain verification	TXT	{domain}	{value shown in iCloud}The personal TXT record shown in iCloud's Custom Email Domain setup.
Receiving mail	MX	{domain}	priority 10 · mx01.mail.icloud.comDelete your existing MX records first.
Receiving mail	MX	{domain}	priority 10 · mx02.mail.icloud.com
SPF	TXT	{domain}	v=spf1 include:icloud.com ~allApple shows the value in quotes; leave them out if your registrar doesn't support them, and use a TTL of 3600.
DKIM	CNAME	sig1._domainkey.{domain}	sig1.dkim.{domain}.at.icloudmailadmin.comPut your own domain where Apple's example says example.com.
DMARC optional	TXT	_dmarc.{domain}	v=DMARC1; p=none; rua=mailto:{report-address}Apple doesn't suggest a DMARC record for custom domains.

SPF

Add include:icloud.com to the SPF record at your root domain, for example v=spf1 include:icloud.com ~all, placing it before ~all in an existing record. It authorizes iCloud's servers for your domain; Apple doesn't say which Return-Path domain custom-domain mail uses, so SPF alignment isn't documented.

DKIM

One CNAME, sig1._domainkey.{domain}, pointing to sig1.dkim.{domain}.at.icloudmailadmin.com with your own domain in the middle. The key itself lives on Apple's side behind the CNAME.

DMARC alignment

Apple doesn't say. DKIM is the likely aligned identifier, since the sig1 key is published under your domain through the CNAME; the envelope domain that SPF would check is undocumented.

Common mistakes

Delete existing MX records before adding mx01 and mx02.mail.icloud.com, both with priority 10.
Replace example.com in Apple's DKIM value with your own domain.
If your registrar doesn't accept @, quotes or trailing periods, use the domain name as the host and drop the quotes and trailing dots.
A registrar lock on the domain blocks setup with iCloud Mail.
The verification TXT is personal to your setup, so copy it from iCloud.
Custom Email Domain needs iCloud+ and two-factor authentication, and isn't available in every country or region.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises iCloud Mail

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

SPF include, current or legacy: icloud.com
Default DKIM selectors: sig1
DKIM keys delegated (CNAME) to *.icloudmailadmin.com

Questions

What SPF record does iCloud Mail need?+

What are the DKIM records for iCloud Mail?+