Set it up, step by step. For your sending tools, your DNS host, and the bounce in front of you.
160 guides in seven sections: SPF and DKIM for 92 sending tools, the DNS editors of 14 hosts, and what 17 bounce codes mean. For the concepts first, start with Learn.
No guide matches that. Try the tool's name, your DNS host, or the code from the bounce.
Source configuration. Set up SPF and DKIM for the tools that send as you.
92 guidesAll 92 in one list
Google Workspace SPF and DKIM setupThe SPF include, the google._domainkey TXT, and the Start authentication click people miss.
Microsoft 365 SPF and DKIM setupThe SPF record, the two Defender portal CNAMEs, and the onmicrosoft.com alignment trap.
Amazon SES SPF and DKIM setupThe three Easy DKIM CNAMEs that align, the custom MAIL FROM for SPF, and the per-Region trap.
Twilio SendGrid SPF and DKIM setupThe three CNAMEs and DMARC TXT from Domain Authentication, and the appended-domain trap.
Mailchimp SPF and DKIM setupTwo DKIM CNAMEs, no SPF step, and why verified is not authenticated.
Klaviyo SPF and DKIM setupA branded sending subdomain, a root-domain From address, and no SPF record of yours.
HubSpot SPF and DKIM setupTwo DKIM CNAMEs and an SPF include from the console, plus the From rewrite until connected.
Mailgun SPF and DKIM setupThe records on your sending subdomain, and the From address that keeps them aligned.
Postmark SPF and DKIM setupThe DKIM record, the pm-bounces CNAME, and why Postmark asks for no SPF include.- Brevo SPF and DKIM setupThe Brevo code, the DKIM record, why SPF waits for a dedicated IP, and the records to keep.
- Constant Contact SPF and DKIM setupTwo DKIM CNAMEs, no SPF step, and the ccsend.com rewrite that means you are not done.
- ActiveCampaign SPF and DKIM setupThe two DKIM CNAMEs, the return-path CNAME, and the Verified-is-not-aligned trap.
Salesforce SPF and DKIM setupWhich Salesforce product you send from decides the records, and DKIM carries DMARC.- Zoho SPF and DKIM setupZoho Mail and Zoho Campaigns need separate records; one setup does not cover the other.
Zendesk SPF and DKIM setupThe SPF include, two DKIM CNAMEs, enable signing last, and the DMARC step Zendesk skips.- Shopify SPF and DKIM setupThe CNAMEs that cover DKIM and SPF, one DMARC record, and the rewrite to shopifyemail.com.
- Intercom SPF and DKIM setupThe two CNAMEs that align both SPF and DKIM, and the validate click people skip.
- MailerLite SPF and DKIM setupThe litesrv DKIM CNAME, the SPF and verification TXTs, and the appended-domain trap.
- GetResponse SPF and DKIM setupThe DKIM TXT from the pop-up, the optional SPF, and the via GetResponse-mail.com sign.
- Campaign Monitor SPF and DKIM setupThe cm DKIM TXT, the SPF include, the required DMARC, and the TTL wait before a re-check.
- AWeber SPF and DKIM setupThe three AWeber DKIM CNAMEs, why there is no SPF record, and the public-address trap.
- Kit (ConvertKit) SPF and DKIM setupThe two ck-prefixed CNAMEs that put Kit's return-path and DKIM on your domain.
- Mailjet SPF and DKIM setupThe SPF include and mailjet._domainkey TXT, and why one address is not the domain.
- SparkPost SPF and DKIM setupThe DKIM TXT that aligns by default and the return-path CNAME that covers SPF.
- Freshdesk SPF and DKIM setupFour fwdkim CNAMEs, the forwarding Freshdesk needs, and why it calls DKIM mandatory.
- Marketo SPF and DKIM setupThe mktomail.com include, the DKIM that carries DMARC, and the SPF-verified trap.
- Front SPF and DKIM setupWhich Front channel needs records, where to copy them, and why alignment must stay relaxed.
- Help Scout SPF and DKIM setupTwo fixed strong1 and strong2 CNAMEs, no SPF record, and the DNS proxy that breaks DKIM.
- SMTP2GO SPF and DKIM setupThree CNAMEs for SPF, DKIM, and tracking, and the verified-sender rule since April 2025.
- Pipedrive SPF and DKIM setupSync needs no DNS; Campaigns needs three CNAMEs, a DMARC TXT, and a verified sender.
- Drip SPF and DKIM setupThree CNAMEs, no SPF include, and the s1/s2 selector clash that keeps Drip from verifying.
- Mandrill SPF and DKIM setupThe mte1 and mte2 CNAMEs, the DMARC Mandrill insists on, and the return-path option.
- MailerSend SPF and DKIM setupOne SPF TXT, two DKIM CNAMEs, and the mta return-path that makes SPF align.
- Resend SPF and DKIM setupThe resend._domainkey TXT and the MX and SPF records on the send subdomain.
- Customer.io SPF and DKIM setupFour records on a cio subdomain, DMARC at the root, and the strict tag that breaks it.
- SocketLabs SPF and DKIM setupThe bounce-domain CNAME that aligns SPF, and the DKIM CNAME or TXT key.
- Iterable SPF and DKIM setupWhere Iterable keeps the records, and why one setting regenerates them all.
- Pardot SPF and DKIM setupThe validation key, the DomainKey TXT, and why SPF never aligns for Pardot.
- Fastmail SPF and DKIM setupMX, the messagingengine SPF include, three fm DKIM CNAMEs, and the ?all in Fastmail's record.
- Proton Mail SPF and DKIM setupMX, SPF, and three DKIM CNAMEs that let Proton rotate keys for you.
- IONOS SPF and DKIM setupThe regional SPF include, the three DKIM CNAMEs, and what moving your name servers breaks.
- Rackspace Email SPF and DKIM setupThe emailsrvr.com include, the DKIM switch, and the TXT record you publish yourself.
- Mimecast SPF and DKIM setupThe regional include, the signing definition plus policy, and the unsaved-key mistake.
- Barracuda Email Gateway Defense SPF and DKIM setupBarracuda's regional SPF include, DKIM signed before the relay, and the footer that breaks it.
- Loops SPF and DKIM setupSPF and MX on an envelope subdomain, DKIM beside them, and the priority people drop.
- Proofpoint Essentials SPF and DKIM setupThe per-region SPF include and the 2048-bit DKIM key you generate and verify in the console.
- Gorgias SPF and DKIM setupThe gor and gor2 DKIM CNAMEs, the em return path, and why some accounts get TXT records.
- Bird SPF and DKIM setupThe DKIM TXT and the send. return-path CNAME; no apex SPF include is ever needed.
- Squarespace SPF and DKIM setupOne DKIM CNAME and a generated _dmarc TXT, with no SPF record to add.
- Sender SPF and DKIM setupThe sendersrv.com include, the sender._domainkey CNAME, and the two weak defaults to fix.
- BigCommerce SPF and DKIM setupOne SPF include, no DKIM record to add, and why SPF alone carries your order mail.
- Mailtrap SPF and DKIM setupFour CNAMEs, the rwmt1 and rwmt2 selectors, and no SPF include to hunt for.
- SMTP.com SPF and DKIM setupThe _spf.smtp.com include, the smtpkey CNAME, and the support step that turns signing on.
- Emarsys SPF and DKIM setupThe SPF include, the key5 and key6 CNAMEs, and the bounces CNAME that makes SPF align.
- Yandex 360 SPF and DKIM setupMX, the redirect= SPF, the mail._domainkey key, and the second-sender trap.
- Kayako SPF and DKIM setupThe SPF include, the three CNAMEs, and why the DKIM box waits for DNS.
- Wix SPF and DKIM setupThe CNAMEs Wix asks for, and why its fifth record wants your _dmarc name.
- Netcore Email API SPF and DKIM setupSPF, DKIM and an envelope CNAME from your dashboard, then a review before sending.
- Greenhouse SPF and DKIM setupWhy Greenhouse puts its records on a gh-mail subdomain, and the MX that subdomain needs.
- HappyFox SPF and DKIM setupThe SPF include, two DKIM CNAMEs, and the HappyFox address an unverified channel sends from.
- DocuSign SPF and DKIM setupClaim the domain, add a subdomain, publish two DKIM CNAMEs, SPF, and MX from DocuSign Admin.
- Lever SPF and DKIM setupNo Lever record to publish: candidate mail leaves through each recruiter's mailbox.
- Omnisend SPF and DKIM setupMailgun-shaped SPF, DKIM and DMARC records, and the sender address rule behind them.
- Moosend SPF and DKIM setupOne include, the ms selector key, and the all-at-once check that needs DMARC.
- SendPulse SPF and DKIM setupThe mxsspf.sendpulse.com include, the sign._domainkey key, and the From-domain rule.
- Benchmark Email SPF and DKIM setupTwo account-specific Benchmark CNAMEs, the DMARC record it insists on, and the From rewrite.
- Elastic Email SPF and DKIM setupThe SPF include, the api DKIM TXT, and the bounce-domain CNAME that makes SPF align.
- Braze SPF and DKIM setupWhich SendGrid, SparkPost, or SES records Braze hands you, and why your apex only gets DMARC.
- Salesforce Marketing Cloud SPF and DKIM setupDelegate the sending subdomain or publish its zone file, then check its DMARC rua.
- Atlassian SPF and DKIM setupAtlassian's five records, the address pick in Jira and Confluence, and the early-switch trap.
- Calendly SPF and DKIM setupCalendly has no DNS records; only invitations and connected Gmail or Outlook send as you.
- Typeform SPF and DKIM setupThe Mailgun-backed records for an Automation email domain, and what stays on Typeform.
- Substack SPF and DKIM setupEvery post leaves from substack.com, so there is nothing to publish for your domain.
- beehiiv SPF and DKIM setupThe beehiiv ownership record and email CNAMEs, the DMARC it requires, and the wait for Live.
- Ghost SPF and DKIM setupA custom sending domain on Ghost(Pro) or Mailgun's records on self-hosted Ghost, plus DMARC.
- Mailmodo SPF and DKIM setupA DKIM TXT, a bounce CNAME and a DMARC TXT per domain, with no SPF include.
- Dotdigital SPF and DKIM setupA new subdomain delegated to Dotdigital, and the DMARC reports that go to Dotdigital, not you.
- Ortto SPF and DKIM setupThree CNAMEs from Custom domains, an optional SPF include, and the silent fallback.
- SendLayer SPF and DKIM setupFive records on the sl subdomain, and why relaxed alignment has to stay.
- Amazon WorkMail SPF and DKIM setupWorkMail's record page, the MAIL FROM that aligns SPF, and the March 2027 end of support.
- iCloud Mail SPF and DKIM setupThe include:icloud.com SPF, the sig1 DKIM CNAME with your domain inside it, and the MX swap.
- Namecheap Private Email SPF and DKIM setupMX, SPF and a pasted DKIM key, under the selector your subscription date decides.
- Keap SPF and DKIM setupThree app-named CNAMEs, the SPF include, and the free-mail From address Keap rewrites.
- Ontraport SPF and DKIM setupAn Entri-published DKIM CNAME, the From-address step, and the quiet ontramail.com fallback.
- EmailOctopus SPF and DKIM setupFour CNAMEs and a DMARC TXT, the eom return path, and why Verified beats Partially verified.
- Buttondown SPF and DKIM setupDelegate a subdomain with two NS records, or publish Buttondown's manual Postmark records.
- Sendy SPF and DKIM setupSendy sends through Amazon SES, so the records to publish are SES records.
- WordPress SPF and DKIM setupRoute wp_mail through a mailer that signs as you; a forced From alone makes it worse.
- Webflow SPF and DKIM setupForm notifications leave from a Webflow address, so there is nothing to publish.
- Hostinger Email SPF and DKIM setupTwo MX hosts, one SPF include, three hostingermail DKIM CNAMEs, and the Titan Email mix-up.
- Okta SPF and DKIM setupFour records on a subdomain, three of them SendGrid CNAMEs, and the fallback to okta.com.
- Auth0 SPF and DKIM setupAuth0 sends through the provider you connect; whose records you publish and the From trap.
- Show all 92
DNS providers. Add the records in your DNS host, step by step.
15 guidesAll 15 in one list- Adding DMARC, SPF, and DKIM records in GoDaddyThe Domain Portfolio path, the @ apex, and the doubled-hostname trap.
- Adding DMARC, SPF, and DKIM records in NamecheapThe Advanced DNS panel, the Save all changes step, and the Email Forwarding SPF.
- Adding DMARC, SPF, and DKIM records in AWS Route 53The console path, the double quotes, the blank apex, and the scoped IAM policy.
- Adding DMARC, SPF, and DKIM records in Google Cloud DNSThe blank apex, the Add item split for long DKIM keys, and the role you need.
- Adding DMARC, SPF, and DKIM records in Azure DNSThe Record sets path, the @ apex, and a DKIM key Azure splits for you.
Adding DMARC, SPF, and DKIM records in CloudflareThe DNS editor, why the orange cloud never touches TXT, and the Email Routing SPF.- Adding DMARC, SPF, and DKIM records in SquarespaceWhere Google Domains moved, the Custom Records path, and the Text field.
- Adding DMARC, SPF, and DKIM records in HostingerTwo ways into the hPanel editor, the @ apex, and the one-subscription trap.
- Adding DMARC, SPF, and DKIM records in IONOSThe Actions menu path, the IONOS SPF entry, and why IONOS mail does DKIM by CNAME.
- Adding DMARC, SPF, and DKIM records in BluehostThe Portal DNS tab, the Refers to dropdown, and the default SPF to delete first.
- Adding DMARC, SPF, and DKIM records in WixWhether you edit DNS in Wix at all, and why the apex Host Name is left blank.
- Adding DMARC, SPF, and DKIM records in OVHcloudThe Add an entry form, the blank apex sub-domain, and the reset button to avoid.
- Adding DMARC, SPF, and DKIM records in DigitalOceanThe Networking path, the @ apex, the split DKIM key, and doctl or Terraform.
- Adding DMARC, SPF, and DKIM records in PorkbunThe Answer field, the blank apex, and the parking records to delete first.
- Adding DMARC, SPF, and DKIM records at any providerFind who answers your DNS, then add the four TXT records in any panel.
- Show all 15
Protocols and concepts. How email authentication actually works.
3 guidesAll 3 in one list- What is ARC (Authenticated Received Chain)?How a forwarder records the authentication it saw, and when a receiver believes it.
- Envelope-from vs header-from: the two sender addressesThe envelope address SPF checks and the visible From DMARC judges, side by side.
- The DMARC fo tag and failure (ruf) reportsWhat fo=0, 1, d and s ask for, and why the big receivers send no failure reports anyway.
Troubleshooting. Decode the bounce. Fix the failure.
10 guidesAll 10 in one list- Gmail 550 5.7.26: why your mail bounced and how to fix itGmail refused unauthenticated mail; find the source and give it aligned SPF or DKIM.
- 550 5.7.1: email rejected per DMARC policy, and how to fix itOn Microsoft 365 it is usually DMARC, but read the text after the code first.
- 550 5.7.23: your mail failed SPF, and how to fix itSPF checked the envelope IP and it was not listed; add the sender, mind the pool.
- SPF PermError: too many DNS lookups, and how to fix itWhat counts toward the 10-lookup cap and how to come back under it.
- Reverse DNS and PTR records: why mail gets rejectedFCrDNS explained, where the PTR record lives, and the Gmail 5.7.25 bounce.
Yahoo 554 5.7.9 and Gmail bulk-sender errors, decodedWhich Yahoo and Gmail codes mean fix authentication and which mean slow down.- DKIM failed (dkim=fail): why your signature did not verifyThe signature did not verify: a changed body, a missing selector, or the wrong key.
- SMTP error codes: how to read an email bounceReply code, enhanced code, and the text after them: which part to trust.
- SPF ~all vs -all: softfail, hardfail, and which to useWhat softfail and hardfail tell a receiver, and why DMARC makes softfail the safer pick.
- DMARC record set up but no reports yet: what to checkReports arrive once a day after the UTC day ends, and what to check when none come.
- Show all 10
Bounce codes. What each SMTP bounce code means, and whose problem it is.
17 guidesAll 17 in one list- 550 5.7.515: Microsoft wants SPF, DKIM, and DMARC before it takes your mailThe Microsoft 2025 bar: SPF, DKIM, and DMARC with at least one aligned pass.
- 550 5.7.509: rejected because your DMARC policy says rejectYour own p=reject, honored by Microsoft; fix the sender's alignment, not the policy.
- 550 5.7.511: Microsoft refuses mail from your sending IPA banned IP at Microsoft; find it, check for abuse, then email delist@microsoft.com.
- 550 5.7.606: your sending IP is banned at MicrosoftAny code from 5.7.606 to 5.7.649 is a banned IP; find whose it is, then use the portal.
- 550 5.7.28: Gmail flagged an unusual rate of unsolicited mailA rate verdict on the sending IP, not the message; stop the burst and rebuild slowly.
- 421 4.7.0: Gmail is temporarily deferring your mailOne code covers eight reasons; the words after it say which one to fix.
- 421 4.7.0 [TS01, TS02, TS03]: Yahoo is deferring mail from your IPYahoo's TS deferrals are a reputation throttle; pace, cut complaints, then ask support.
- 5.1.1 user unknown: the mailbox does not existTypos, departed staff, stale lists, and why to suppress after the first bounce.
- 5.1.2: the recipient's domain does not exist in DNSHow to tell a typo from a dead domain with one DNS lookup.
- 5.2.1: the mailbox exists but is disabledThe mailbox exists but is switched off; suppress it and restore on a positive signal.
- 5.2.2 mailbox full: the recipient is over quotaOver quota is their problem to fix, but weeks of it is a list-hygiene signal.
- 5.2.3: your message is too large for the recipient's mailboxOne mailbox's size limit, the encoding overhead, and the ways around a large file.
- 5.3.4: your message exceeds the receiving system's size limitThe system-wide size ceiling, why encoded mail is bigger, and the link fix.
- 4.4.1: connection to the recipient's mail server timed outWhy a timeout is almost always the receiving side, and the two cases where it is yours.
- 4.4.7: the message expired before it could arriveThe retry window ran out; the earlier error quoted in the bounce is the real cause.
- 5.4.4: no route to the recipient's domainDNS answered but no mail route exists; check their MX records before you act.
- 5.7.10: read the SMTP error beside the codeGmail's 523 5.7.10 is a pipelining error; read the text before touching TLS.
- Show all 17
DNS records. What each record does, tied to deliverability.
11 guidesAll 11 in one list- What is a DNS record? DNS records explainedOne instruction stored against your domain, and why a wrong one breaks mail.
- What is an MX record? (and why a wrong one loses mail)Where mail to your domain goes, and why a wrong MX loses it quietly.
- What is an A record? (A and AAAA, explained)A name to an IPv4 address, AAAA for IPv6, and the reverse match Gmail expects.
- What is a CNAME record? (and why not at your apex)One name pointing at another, why never at the apex, and how it carries DKIM.
- What is a TXT record (and why SPF, DKIM, and DMARC all live in one)?Free text in DNS, where SPF, DKIM, and DMARC live, and the rules that bite.
- What are NS records? (and why your DNS edit did nothing)Which provider answers your DNS, and why an edit elsewhere does nothing.
- What is an SOA record? (Start of Authority, explained)The zone's serial and timers, and why a new record can read as not found.
- What is a PTR record? (reverse DNS, explained)The IP to name lookup mail servers check, and why your IP host sets it.
- What is an SRV record? (and why email rarely needs one)Where a service lives, why it does not route mail, and the one email use.
- What is DNSSEC? (and what it means for email)Signed DNS answers, what that means for email, and the rollover that goes wrong.
- DNS propagation and TTL: why your change isn't live yetNo push, only caches: why a change is not live everywhere yet.
- Show all 11
Glossary. The email-authentication vocabulary, in plain English.
12 guidesAll 12 in one list- What is the Return-Path? (envelope from)The hidden envelope address that takes your bounces and decides SPF.
- What is the Header From address?The From line people read, why anyone can write anything there, and how DMARC anchors to it.
- What is a DKIM selector?The s= label that names the DNS record holding a DKIM key, and why each vendor gets its own.
- What is DMARC alignment?Why an SPF or DKIM pass only counts for DMARC when its domain matches the From.
- What is a DMARC aggregate report? (RUA)The daily XML receipts receivers send about mail using your domain, and what is inside.
- What is a DMARC forensic report? (RUF)The per-message failure report almost nobody sends, and why RUA does the real work.
- What is an organizational domain?The registrable root DMARC falls back to, by PSL in RFC 7489 and by tree walk in DMARCbis.
- What is a DMARC record?The TXT record at _dmarc: its tags, the rules that bite, and a safe first record.
- What is a DMARC policy? (p=none, quarantine, reject)What p=none, quarantine and reject each ask a receiver to do with failing mail.
- What does quarantine mean in email?Where p=quarantine mail lands at each receiver, and how it differs from reject.
- What is email spoofing?How anyone can write your domain into a From line, and what lets receivers refuse it.
- What is a Verified Mark Certificate? (VMC)The certificate that proves the logo in your BIMI record is yours, and who needs one.
- Show all 12
Start with one domain. See it with your own data.
Free for one domain, no card. Add one DNS record and the first reports usually arrive within a day.