Barracuda Email Gateway Defense SPF and DKIM setup

What you are setting up

Barracuda Email Gateway Defense (formerly Barracuda Essentials) sits in front of your mail platform. Inbound mail hits Barracuda first; if you also turn on outbound filtering, your Microsoft 365, Google Workspace, or on-premises server hands every outgoing message to Barracuda, and Barracuda's servers deliver it. That makes Barracuda the last hop the receiver sees, so its IP ranges have to be in your SPF record. DKIM is different: Email Gateway Defense does not sign outbound mail, so the signature has to be applied by your mail platform before the message reaches Barracuda, and Barracuda has to leave it intact.

Publish SPF and DKIM

SPF. Barracuda publishes one SPF include per hosting region. Pick the one that matches the region your Email Gateway Defense instance was deployed in, and add it to the existing SPF record of every domain that sends outbound mail through Barracuda:

US:  include:spf.ess.barracudanetworks.com
UK:  include:spf.ess.uk.barracudanetworks.com
DE:  include:spf.ess.de.barracudanetworks.com
CA:  include:spf.ess.ca.barracudanetworks.com
AU:  include:spf.ess.au.barracudanetworks.com
IN:  include:spf.ess.in.barracudanetworks.com

Merge the include into the record you already have, next to your mail platform's own include. A Microsoft 365 tenant in the US region ends up looking like this:

Type:  TXT
Host:  @
Value: v=spf1 include:spf.protection.outlook.com include:spf.ess.barracudanetworks.com -all

Keep your platform's include in place. Mail that leaves the tenant without passing through Barracuda (some system notifications, or any domain you have not enabled for outbound filtering) still comes from the platform's IPs. Barracuda's own example ends in -all; use ~all while you are still confirming senders and tighten it later.

DKIM. There is nothing to publish for Barracuda. Enable DKIM signing on the platform that originates the mail, exactly as you would without a gateway: the two selector CNAMEs in the Microsoft 365 Defender portal, the google._domainkey TXT record for Google Workspace, or your own signing configuration on an on-premises server. Barracuda relays the signed message unchanged, so the signature still verifies and still carries d=yourdomain.com.

Add DMARC

Standard _dmarc TXT record, nothing Barracuda-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Barracuda gotcha

Anything Barracuda adds after signing breaks DKIM. Barracuda's own documentation is blunt about it: adding or modifying content after signing, such as appending a disclaimer, will break DKIM. Because your platform signs first and Barracuda processes second, an outbound footer, a disclaimer, or a content rewrite in Email Gateway Defense invalidates a signature that was perfectly good when it left Microsoft 365 or Google Workspace. The symptom in your DMARC reports is the Barracuda source showing SPF aligned but DKIM failing on every message. Apply disclaimers on the mail platform, before signing, and keep Barracuda's outbound processing hands-off.

The second trap is the region. The six includes resolve to different IP ranges, and a UK instance with the US include in DNS fails SPF on every relayed message. If you are not sure which region you are in, check which regional console URL you log in to, and count the lookups before you add more: spf.ess.barracudanetworks.com is one include on top of your platform's, and the 10-lookup limit is easy to reach behind a gateway.

Confirm it worked

• Test the SPF record. Run your domain through our SPF tester and confirm the regional Barracuda include resolves and the record stays under 10 lookups.
• Send a test and read the headers. Send an outbound message that leaves through Barracuda, open the received copy, and confirm spf=pass, a DKIM signature with d=yourdomain.com, and dmarc=pass. Our header analyzer reads it back plainly, and a DKIM fail here means something in Barracuda touched the body after signing.
• Watch the reports. Barracuda Networks should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox, with both SPF and DKIM passing.