emailsecops
Menu
Guides

Mailjet SPF, DKIM and DMARC setup

Add include:spf.mailjet.com to your root SPF record and publish the mailjet._domainkey TXT key Mailjet shows for your domain. DKIM aligns with your From domain; SPF aligns only with a custom bnc3 Return-Path, which Mailjet support activates.

Transactional and marketing email platform · reviewed October 13, 2026 against Mailjet's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Mailjet account: copy it from Mailjet's setup screen, which shows the exact record.

ForTypeHostValue
SPF TXT {domain} v=spf1 include:spf.mailjet.com ~allMerge the include into your existing SPF record.
DKIM TXT mailjet._domainkey.{domain} k=rsa; p={public-key}Copy the key from Account Settings > Domains and Senders > Setup SPF/DKIM authentication.
Return path optional CNAME bnc3.{domain} bnc3.mailjet.comPaid accounts only; after publishing it, open a support ticket so Mailjet activates it.
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Mailjet suggests starting at p=none and moving to quarantine and reject gradually.

SPF

Mailjet checks for include:spf.mailjet.com in your root SPF record, for example v=spf1 include:spf.mailjet.com ~all. That include doesn't make SPF align, because the default Return-Path is on bnc3.mailjet.com; only the custom bnc3.{domain} Return-Path aligns, under relaxed alignment.

DKIM

One TXT record at mailjet._domainkey.{domain} with the public key Mailjet shows; keys are 2048-bit by default since April 2024, with 1024- and 4096-bit selectable when you regenerate. Rotation is manual: Regenerate Key, then replace the DNS record; existing domains aren't upgraded automatically.

DMARC alignment

DKIM aligns: Mailjet signs with the key at mailjet._domainkey.{domain}. SPF doesn't align by default (Return-Path bnc3.mailjet.com); it aligns only with the custom bnc3.{domain} Return-Path and relaxed SPF alignment.

Common mistakes

  • Mailjet's Quick Start calls the DKIM record a CNAME, but the value is a TXT public key, so publish it as TXT.
  • Some DNS hosts append the domain to the host field automatically or need the TXT value in double quotes.
  • Some DNS hosts reject or truncate 2048- or 4096-bit keys; regenerate a 1024-bit key if needed, which requires the whole domain to be validated.
  • The custom Return-Path is paid-only, activated by support and limited to one per API key; keep aspf relaxed, since bnc3.{domain} never matches the From domain exactly.
  • Mailjet's API default SPF value ends in ?all, while its help center uses ~all.
  • Domain validation is per API key, so subaccounts need their own validation.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Mailjet

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: spf.mailjet.com
  • Default DKIM selectors: mailjet

Questions

What SPF record does Mailjet need?+
Mailjet checks for include:spf.mailjet.com in your root SPF record, for example v=spf1 include:spf.mailjet.com ~all. That include doesn't make SPF align, because the default Return-Path is on bnc3.mailjet.com; only the custom bnc3.{domain} Return-Path aligns, under relaxed alignment.
What are the DKIM records for Mailjet?+
One TXT record at mailjet._domainkey.{domain} with the public key Mailjet shows; keys are 2048-bit by default since April 2024, with 1024- and 4096-bit selectable when you regenerate. Rotation is manual: Regenerate Key, then replace the DNS record; existing domains aren't upgraded automatically.
Does Mailjet mail pass DMARC?+
DKIM aligns: Mailjet signs with the key at mailjet._domainkey.{domain}. SPF doesn't align by default (Return-Path bnc3.mailjet.com); it aligns only with the custom bnc3.{domain} Return-Path and relaxed SPF alignment.
Do I need a separate DMARC record for Mailjet?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources