Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your SparkPost account: copy it from SparkPost's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| DKIM | TXT | {selector}._domainkey.{domain} | v=DKIM1; k=rsa; h=sha256; p={public-key}SparkPost generates the key when you add the sending domain; copy the selector and value it shows. |
| Return pathUS accounts optional | CNAME | {bounce-subdomain}.{domain} | sparkpostmail.comAdd the bounce subdomain as a sending domain, verify it by CNAME, then use it as the return path or default bounce domain. |
| Return pathEU accounts optional | CNAME | {bounce-subdomain}.{domain} | eu.sparkpostmail.com |
| Return pathEnterprise accounts optional | CNAME | {bounce-subdomain}.{domain} | {public_tenant_id}.mail.e.sparkpost.com |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address} |
SPF
No SPF include is needed at your root domain: SparkPost replaces the envelope sender with its own address unless you use a CNAME-verified bounce domain, so receivers don't check your root SPF record for SparkPost mail. SPF can align only when a subdomain of your From domain, CNAMEd to sparkpostmail.com (eu.sparkpostmail.com for EU accounts), is the bounce domain.
DKIM
One TXT record under a selector SparkPost generates per sending domain (API examples look like scph0316), with a 2048-bit RSA key by default; a 1024-bit key can be requested if your DNS host can't publish multi-string TXT records. Keys aren't rotated automatically: you replace them through the API, and a changed key stays unverified until its TXT record verifies.
DMARC alignment
DKIM aligns once the TXT key verifies, because SparkPost signs with d= set to your sending domain. SPF aligns only with a CNAME-verified bounce subdomain of your From domain, under relaxed alignment; otherwise only DKIM can align.
Common mistakes
- SparkPost's old support articles now redirect to Bird's Email platform docs, whose records (such as us1.bounce.bird.com) are for Bird Email workspaces, not classic SparkPost accounts.
- Put the bounce domain on a subdomain, because a CNAME can't coexist with the other records at your root.
- A 2048-bit key gives a TXT value of around 400 characters, which must be split into several quoted strings unless your DNS provider does it for you.
- Verify a new sending domain within two weeks, or SparkPost removes it from the account.
- A domain and its subdomains can only be added to one SparkPost account.
- Verifying ownership by mailbox instead of DNS means SparkPost can't DKIM-sign your mail.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed: