Knowledge Base

Set up SPF and DKIM for the tools that send as you.

• Google Workspace SPF and DKIM setup

  Publish SPF, turn on DKIM, and avoid the two-step activation trap that quietly leaves Google Workspace mail unsigned.

• Microsoft 365 SPF and DKIM setup

  The exact SPF record, the two DKIM CNAMEs to copy out of the Defender portal, and the onmicrosoft.com alignment trap that fails your mail.

• Amazon SES SPF and DKIM setup

  Why Easy DKIM, not the SPF include everyone pastes, is what aligns SES mail, plus the custom MAIL FROM and the per-region trap.

• Twilio SendGrid SPF and DKIM setup

  Run Domain Authentication, publish the CNAMEs SendGrid generates, and dodge the DNS host trap that doubles your record names.

• Mailchimp SPF and DKIM setup

  Authenticate your domain (not just verify it) with two CNAMEs, and why Mailchimp's old SPF step is gone.

• Klaviyo SPF and DKIM setup

  Set up a branded sending domain, send from your root domain (not the subdomain), and skip the SPF record you do not need.

• HubSpot SPF and DKIM setup

  Connect your email sending domain, copy the two DKIM CNAMEs and SPF from the console, and clear the gate that blocks sending as your domain.

• Mailgun SPF and DKIM setup

  Publish SPF and DKIM on your sending subdomain, use the right DKIM selector, and avoid the from-address trap that breaks alignment.

• Postmark SPF and DKIM setup

  Publish DKIM and the Return-Path CNAME, skip SPF, and learn why an SPF-fail in your DMARC reports is expected and harmless.

• Brevo SPF and DKIM setup

  Authenticate your domain (formerly Sendinblue), publish the Brevo code and DKIM records, and keep the records you must never delete.

• Constant Contact SPF and DKIM setup

  Turn on self-authentication with two DKIM CNAMEs, skip SPF, and fix the silent from-address rewrite that means you are not done yet.

• ActiveCampaign SPF and DKIM setup

  Publish the two DKIM CNAMEs, let ActiveCampaign handle SPF, and clear the Verified-is-not-aligned trap that fails DMARC.

• Salesforce SPF and DKIM setup

  Which records you publish depends on which Salesforce you send from: Sales and Service Cloud, Account Engagement (Pardot), or Marketing Cloud.

• Zoho SPF and DKIM setup

  Zoho Mail and Zoho Campaigns have separate setups: the records for each, the region-specific Campaigns include, and why one does not cover the other.

• Zendesk SPF and DKIM setup

  Make Zendesk send support mail as your domain: the two DKIM CNAMEs, the enable-DKIM-last rule, and the DMARC step Zendesk skips.

How email authentication actually works.

• What is ARC (Authenticated Received Chain)?

  When a mailing list or forwarder rewrites your mail, SPF and DKIM break and DMARC fails. ARC is how the next hop preserves the original verdict. What it is, when it helps, and its limits.

Decode the bounce. Fix the failure.

• Gmail 550 5.7.26: why your mail bounced and how to fix it

  Gmail now rejects bulk mail that isn't authenticated. What the 550 5.7.26 bounce actually means, the three things that cause it, and how to confirm you've fixed it.

What each record does, tied to deliverability.

• What is a TXT record (and why SPF, DKIM, and DMARC all live in one)?

  A TXT record holds free-form text in DNS. It's also where every email-authentication record you publish actually lives. What it is, the quoting and length rules that bite, and how to verify one.