Knowledge Base

Set up SPF and DKIM for the tools that send as you.

• Google Workspace SPF and DKIM setup

  Publish SPF, turn on DKIM, and avoid the two-step activation trap that quietly leaves Google Workspace mail unsigned.

• Microsoft 365 SPF and DKIM setup

  The exact SPF record, the two DKIM CNAMEs to copy out of the Defender portal, and the onmicrosoft.com alignment trap that fails your mail.

• Amazon SES SPF and DKIM setup

  Why Easy DKIM, not the SPF include everyone pastes, is what aligns SES mail, plus the custom MAIL FROM and the per-region trap.

• Twilio SendGrid SPF and DKIM setup

  Run Domain Authentication, publish the CNAMEs SendGrid generates, and dodge the DNS host trap that doubles your record names.

• Mailchimp SPF and DKIM setup

  Authenticate your domain (not just verify it) with two CNAMEs, and why Mailchimp's old SPF step is gone.

• Klaviyo SPF and DKIM setup

  Set up a branded sending domain, send from your root domain (not the subdomain), and skip the SPF record you do not need.

• HubSpot SPF and DKIM setup

  Connect your email sending domain, copy the two DKIM CNAMEs and SPF from the console, and clear the gate that blocks sending as your domain.

• Mailgun SPF and DKIM setup

  Publish SPF and DKIM on your sending subdomain, use the right DKIM selector, and avoid the from-address trap that breaks alignment.

• Postmark SPF and DKIM setup

  Publish DKIM and the Return-Path CNAME, skip SPF, and learn why an SPF-fail in your DMARC reports is expected and harmless.

• Brevo SPF and DKIM setup

  Authenticate your domain (formerly Sendinblue), publish the Brevo code and DKIM records, and keep the records you must never delete.

• Constant Contact SPF and DKIM setup

  Turn on self-authentication with two DKIM CNAMEs, skip SPF, and fix the silent from-address rewrite that means you are not done yet.

• ActiveCampaign SPF and DKIM setup

  Publish the two DKIM CNAMEs, let ActiveCampaign handle SPF, and clear the Verified-is-not-aligned trap that fails DMARC.

• Salesforce SPF and DKIM setup

  Which records you publish depends on which Salesforce you send from: Sales and Service Cloud, Account Engagement (Pardot), or Marketing Cloud.

• Zoho SPF and DKIM setup

  Zoho Mail and Zoho Campaigns have separate setups: the records for each, the region-specific Campaigns include, and why one does not cover the other.

• Zendesk SPF and DKIM setup

  Make Zendesk send support mail as your domain: the two DKIM CNAMEs, the enable-DKIM-last rule, and the DMARC step Zendesk skips.

• Shopify SPF and DKIM setup

  Authenticate your sender domain with the CNAMEs that handle DKIM and SPF, and stop the silent rewrite to shopifyemail.com.

• Intercom SPF and DKIM setup

  Publish the two CNAMEs that align both SPF and DKIM, and learn why verifying an address is not authenticating the domain.

• MailerLite SPF and DKIM setup

  Publish the litesrv DKIM CNAME plus SPF, and dodge the appended-domain trap that breaks the records.

• GetResponse SPF and DKIM setup

  Publish the DKIM TXT record, skip the optional SPF, and avoid the status that quietly sends via GetResponse.

• Campaign Monitor SPF and DKIM setup

  Publish the cm DKIM TXT plus SPF and DMARC, and know why a verified domain is not signing for the first 30 minutes.

• AWeber SPF and DKIM setup

  Publish the three DKIM CNAMEs, skip SPF, and avoid the free-address rewrite that strips your branding.

• Kit (ConvertKit) SPF and DKIM setup

  Set up a Verified Sending Domain with two CNAMEs (still ck-prefixed after the rebrand) that align both SPF and DKIM.

• Mailjet SPF and DKIM setup

  Publish the SPF include and the mailjet._domainkey DKIM record, and validate the whole domain, not just an address.

• SparkPost SPF and DKIM setup

  Publish the scph DKIM record that aligns by default, plus the optional SPF include and bounce domain for SPF alignment.

• Freshdesk SPF and DKIM setup

  Make Freshdesk send support mail as your domain: the four fwdkim CNAMEs, the forwarding, and why DKIM is now mandatory.

• Marketo SPF and DKIM setup

  Publish SPF and DKIM for Adobe Marketo Engage, and learn why DKIM (not the SPF include) is what carries DMARC.

• Front SPF and DKIM setup

  Find out which Front channel needs SPF and DKIM, copy the records from the Deliverability panel, and use relaxed alignment.

• Help Scout SPF and DKIM setup

  Publish the two fixed strong1 and strong2 DKIM CNAMEs, skip SPF, and avoid the DNS-proxy setting that breaks signing.

• SMTP2GO SPF and DKIM setup

  Verify your sender domain with three CNAMEs that handle SPF, DKIM, and tracking, with no SPF include to add.

• Pipedrive SPF and DKIM setup

  Email sync needs no DNS; Pipedrive Campaigns needs domain authentication. The records, and the verify-sender trap.

Add the records in your DNS host, step by step.

• Adding DMARC, SPF, and DKIM records in GoDaddy

  The exact path through GoDaddy's current DNS editor, the @ apex rule, the doubled-hostname trap, and why you no longer split long DKIM keys by hand.

• Adding DMARC, SPF, and DKIM records in Namecheap

  Namecheap's Advanced DNS panel step by step, the Save all changes step people forget, and the Email Forwarding setting that injects a locked SPF record.

• Adding DMARC, SPF, and DKIM records in AWS Route 53

  The Route 53 console path, the mandatory double-quote rule, multi-string DKIM keys, the blank-apex rule, and the least-privilege IAM for a one-click connection.

• Adding DMARC, SPF, and DKIM records in Google Cloud DNS

  The Cloud DNS console path, why the apex name is blank not @, the Add item split that long DKIM keys need, and the dns.admin role (there is no dns.editor).

• Adding DMARC, SPF, and DKIM records in Azure DNS

  The Azure portal Record sets path, the @ apex rule, why Azure is the easiest provider for long DKIM keys, and the DNS Zone Contributor role you need.

• Adding DMARC, SPF, and DKIM records in Cloudflare

  The Cloudflare DNS path, why the orange-cloud proxy never touches your TXT records, the Email Routing SPF clash to merge, and how Cloudflare handles long DKIM keys for you.

• Adding DMARC, SPF, and DKIM records in Squarespace

  Where Google Domains moved: the Custom Records path, why your nameservers may still say googledomains.com, and the Text field label that trips people up.

• Adding DMARC, SPF, and DKIM records in Hostinger

  The two ways into Hostinger's hPanel DNS editor, the dns-parking.com nameserver check, the @ apex rule, and the one-email-provider trap that breaks SPF.

• Adding DMARC, SPF, and DKIM records in IONOS

  The IONOS control-panel path, the dedicated IONOS SPF entry, why DKIM is a CNAME for IONOS mail, and how it differs for a third-party sender.

• Adding DMARC, SPF, and DKIM records in Bluehost

  The current Bluehost Portal path (not cPanel), the Refers to dropdown, and the default SPF record you must delete before adding your own.

• Adding DMARC, SPF, and DKIM records in Wix

  Why a pointed domain edits DNS at the registrar (not Wix), the Manage DNS Records path, and why the apex Host Name is left blank instead of @.

• Adding DMARC, SPF, and DKIM records in OVHcloud

  The OVHcloud Add an entry wizard, why the apex sub-domain is left blank, the default 3600 TTL, and the Reset zone button to avoid.

• Adding DMARC, SPF, and DKIM records in DigitalOcean

  Infrastructure DNS with no built-in mail: the Networking path, the @ apex, splitting a long DKIM key into quoted strings, and the doctl and Terraform alternatives.

• Adding DMARC, SPF, and DKIM records in Porkbun

  The Porkbun Answer field, the blank apex, the 600-second TTL, and the default pixie.porkbun.com parking records to delete before you set up real DNS.

• Adding DMARC, SPF, and DKIM records at any provider

  The universal walkthrough: find who actually hosts your DNS, open the TXT editor in any panel, paste the right value for each record, and verify it published.

How email authentication actually works.

• What is ARC (Authenticated Received Chain)?

  When a mailing list or forwarder rewrites your mail, SPF and DKIM break and DMARC fails. ARC is how the next hop preserves the original verdict. What it is, when it helps, and its limits.

• Envelope-from vs header-from: the two sender addresses

  Email has two From addresses: the envelope-from your server uses for bounces, and the header-from your recipient sees. SPF checks one, DMARC judges the other. The difference, and why it matters.

• The DMARC fo tag and failure (ruf) reports

  The DMARC fo tag controls when a receiver sends a per-message failure report. What each value means, why the big providers no longer send these reports, and what to use instead.

Decode the bounce. Fix the failure.

• Gmail 550 5.7.26: why your mail bounced and how to fix it

  Gmail now rejects bulk mail that isn't authenticated. What the 550 5.7.26 bounce actually means, the three things that cause it, and how to confirm you've fixed it.

• 550 5.7.1: email rejected per DMARC policy, and how to fix it

  On Microsoft 365, a 550 5.7.1 rejection usually means your mail failed DMARC. Why it isn't always DMARC, the authenticated-but-unaligned trap, and the fix.

• 550 5.7.23: your mail failed SPF, and how to fix it

  Microsoft's 550 5.7.23 and Gmail's 5.7.27 mean a receiver checked SPF and the sending IP wasn't authorized. The usual causes, including the High Risk Delivery Pool, and the fix.

• SPF PermError: too many DNS lookups, and how to fix it

  SPF allows only 10 DNS lookups. Cross the limit and receivers return permerror, which counts as not passing and can take DMARC with it. What counts, and how to come back under.

• Reverse DNS and PTR records: why mail gets rejected

  Strict receivers reject mail from IPs with missing or mismatched reverse DNS (Gmail 550 5.7.25). What forward-confirmed reverse DNS is, where the PTR record lives, and how to fix it.

• Yahoo 554 5.7.9 and Gmail bulk-sender errors, decoded

  Yahoo's 554 5.7.9 and Gmail's 4.7.x and 5.7.x bulk-sender codes, decoded. Which mean fix your authentication, and which mean slow down and fix reputation.

• DKIM failed (dkim=fail): why your signature did not verify

  A dkim=fail means your DKIM signature did not verify. The handful of things that cause it (a modified body is the big one), and how to fix each.

• SMTP error codes: how to read an email bounce

  Every bounce carries an SMTP reply code and an enhanced status code. How to read them, the rule that says retry or fix, and what the common authentication codes mean.

• SPF ~all vs -all: softfail, hardfail, and which to use

  The qualifier at the end of your SPF record decides what receivers do with unlisted senders. The difference, what receivers actually do, and why DMARC changes the choice.

What each record does, tied to deliverability.

• What is a DNS record? DNS records explained

  Every part of how your domain works is a DNS record. The anatomy of one, the types you will actually meet (A, CNAME, MX, TXT, NS), and why a wrong one breaks mail silently.

• What is an MX record? (and why a wrong one loses mail)

  The MX record decides where your inbound email is delivered. How preference works, the null-MX and no-CNAME rules, and why a wrong MX loses mail with no warning.

• What is an A record? (A and AAAA, explained)

  An A record points a name to an IPv4 address, AAAA to IPv6. Why you cannot CNAME your apex, and how forward-and-reverse DNS decides whether Gmail trusts your mail.

• What is a CNAME record? (and why not at your apex)

  A CNAME points one name at another. Why it cannot live at your apex, why MX and NS must never point to one, and how email providers use CNAMEs to run your DKIM.

• What is a TXT record (and why SPF, DKIM, and DMARC all live in one)?

  A TXT record holds free-form text in DNS. It's also where every email-authentication record you publish actually lives. What it is, the quoting and length rules that bite, and how to verify one.

• What are NS records? (and why your DNS edit did nothing)

  NS records decide which provider answers DNS for your domain. The registrar-versus-host trap behind 'I edited my DNS and nothing changed,' and how to find your real DNS host.

• What is an SOA record? (Start of Authority, explained)

  The Start of Authority record holds your zone's serial number and timers. What each field does, and why its negative-cache minimum is the reason a new record reads as not found.

• What is a PTR record? (reverse DNS, explained)

  A PTR record is reverse DNS: it maps an IP back to a hostname. The reverse-DNS tree, why mail servers check it, and why you set it at your IP host, not your DNS panel.

• What is an SRV record? (and why email rarely needs one)

  An SRV record tells clients where to find a service. Why it does not route mail (MX does), the one place it touches email (client autoconfig), and why most domains never need one.

• What is DNSSEC? (and what it protects for email)

  DNSSEC cryptographically signs your DNS so answers cannot be forged. What it protects (including your email-auth records), why it is not required for email, and the rollover that takes a domain offline.

• DNS propagation and TTL: why your change isn't live yet

  DNS propagation is a myth: there is no push, only caching and TTL expiry. Why your DMARC or SPF change is not live everywhere yet, how to pre-lower TTL, and how to check it took.

The email-authentication vocabulary, in plain English.

• What is the Return-Path? (envelope from)

  The hidden envelope address that receives your bounces and decides SPF. What it is, who sets it, and why it rarely matches the From your reader sees.

• What is the Header From address?

  The From address people actually see, and the one DMARC exists to protect. How it differs from the envelope sender and why both alignment checks compare against it.

• What is a DKIM selector?

  The s= label that picks which signing key a receiver looks up. How a selector maps to a DNS record, why vendors each want their own, and how to see yours.

• What is DMARC alignment?

  Why an SPF or DKIM pass is not enough on its own: the domain-matching rule that decides whether a pass counts for DMARC, in relaxed and strict modes.

• What is a DMARC aggregate report? (RUA)

  The daily XML receipts mailbox providers send about mail using your domain. What they contain, what they deliberately leave out, and who sends them.

• What is a DMARC forensic report? (RUF)

  The per-message failure sample almost no provider sends anymore. What ruf= asks for, why privacy killed it, and why aggregate reports do the real work.

• What is an organizational domain?

  The registrable root that DMARC falls back to when a subdomain has no policy of its own. How the Public Suffix List decides it and why it matters for alignment.

• What is a DMARC record?

  The one-line TXT record at _dmarc that publishes your policy and reporting addresses. Its anatomy, the tags that matter, and a safe record to start with.

• What is a DMARC policy? (p=none, quarantine, reject)

  What each policy level actually tells receivers to do with failing mail, what none is for, and how domains climb to reject without losing real mail.

• What does quarantine mean in email?

  Where quarantined mail actually goes: the spam folder for most receivers, an admin hold for some. What p=quarantine asks for and how it differs from reject.

• What is email spoofing?

  How anyone can put your domain in the From line of mail you never sent. What spoofing is, how it differs from a hacked account, and what actually stops it.

• What is a Verified Mark Certificate? (VMC)

  The certificate that proves you own the logo your BIMI record publishes. Who issues VMCs, what they cost, and when you actually need one.