AWeber SPF and DKIM setup

What you are setting up

AWeber sends your newsletters and automations. Authenticating your domain publishes DKIM under your domain so AWeber signs as you and your mail aligns. AWeber is firmly in the DKIM-carries-DMARC camp: it uses three CNAME records for DKIM, asks for a DMARC record beside them, and lists no SPF record at all. The thing to avoid is sending from a free webmail address, which can never be authenticated.

Publish the DKIM records

In AWeber, go to Domains and Addresses. You can let AWeber connect to your DNS provider and add the records for you (Automatically Connect Domain, which AWeber says works with over 40 providers and writes the DKIM and DMARC records together), or click the gear icon next to the domain to see the records and publish them yourself. AWeber uses three DKIM CNAMEs:

Type:  CNAME
Host:  aweber_key_a._domainkey
Value: aweber_key_a.send.aweber.com

Type:  CNAME
Host:  aweber_key_b._domainkey
Value: aweber_key_b.send.aweber.com

Type:  CNAME
Host:  aweber_key_c._domainkey
Value: aweber_key_c.send.aweber.com

The three CNAMEs are deliberate: they let AWeber rotate the underlying DKIM keys for you without you ever touching DNS again. Copy the values from AWeber's setup screen to be safe, though these selectors are consistent across accounts.

Do you need an SPF record? No.

AWeber's setup guide lists DKIM and DMARC records and no SPF record. Its mail uses an AWeber-owned return-path, so SPF authenticates AWeber's domain rather than yours and cannot align with your From address anyway. DKIM alignment is what makes AWeber mail pass DMARC, so there is nothing to add to your SPF record for AWeber.

Add DMARC

Publish one standard _dmarc TXT record. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Keep just one DMARC record (AWeber's checker reports “2 or more DMARC records found” and tells you to delete the duplicate), and do not wrap the value in extra quotes. Build it with our DMARC builder and move past p=none once your reports are clean.

The AWeber gotcha

The most damaging mistake is using a free webmail From address like you@gmail.com. You cannot authenticate a domain you do not control: AWeber marks such an address “Needs authentication” and tells you to ignore the status, because a public domain can never be authenticated. Mail sent that way can never carry your identity under DKIM, and Gmail's and Yahoo's own DMARC policies decide what receivers do with it. Send from an address on a domain you own and publish the three CNAMEs; AWeber recommends the same as your list grows. The other usual snag is the DNS host appending your domain to the CNAME; enter only the host portion.

Confirm it worked

• Check the records. Our DKIM checker confirms the three CNAMEs resolve and a key is published under your domain.
• Send a test and read the headers. Send yourself a campaign, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer makes it readable.
• Watch the reports. AWeber should appear as an aligned, passing source in your DMARC aggregate reports, listed as an identified sender in trustyourinbox.