Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your MailerSend account: copy it from MailerSend's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| SPF | TXT | {domain} | {merged SPF value shown in MailerSend}MailerSend shows a value already merged with your existing SPF, including include:_spf.mailersend.net; replace your record with it. |
| Return path | CNAME | mta.{domain} | mailersend.netmta is the default label; you can change it on the Domains page. |
| DKIM | CNAME | ms1._domainkey.{domain} | ms1._domainkey.mailersend.netCopy the exact targets from the domain's verification page; both CNAMEs are required. |
| DKIM | CNAME | ms2._domainkey.{domain} | ms2._domainkey.mailersend.net |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address} |
SPF
MailerSend asks for an SPF record at your root domain and checks it during verification. It shows the value already merged with your existing SPF, including include:_spf.mailersend.net, so publish exactly that one record. Receivers evaluate SPF on the mta.{domain} Return-Path, though, so that CNAME is what makes SPF align (relaxed).
DKIM
Two CNAMEs, ms1._domainkey and ms2._domainkey, point to 2048-bit keys at mailersend.net that MailerSend rotates itself, with no DNS edits. TXT-based DKIM was discontinued in 2025 and stops working on February 1, 2027; older 1024-bit single-CNAME setups should also move to the ms1/ms2 pair.
DMARC alignment
DKIM aligns through the ms1 and ms2 keys on your domain, and SPF aligns (relaxed) through the mta.{domain} Return-Path CNAME. The root SPF include doesn't take part in alignment.
Common mistakes
- Only one SPF record per domain: replace yours with the merged value MailerSend shows rather than adding a second record.
- Both DKIM CNAMEs are required; with either one missing, the domain stays unverified.
- Legacy TXT-based DKIM stops working on February 1, 2027, so publish the ms1 and ms2 CNAMEs and keep the old record until they verify.
- Record fields are case-sensitive.
- In Google Cloud DNS, entering @ as the DNS name makes the record fail; in Wix, add SPF as a TXT record, not in Wix's SPF section.
- The SPF example in MailerSend's API reference contains a placeholder ip6 range, so publish the value shown for your own domain instead.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed:
How EmailSecOps recognises MailerSend
A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:
- SPF include, current or legacy: _spf.mailersend.net
- Default DKIM selectors: ms1, ms2
- DKIM keys delegated (CNAME) to *.mailersend.net