beehiiv SPF and DKIM setup

What you are setting up

beehiiv is a newsletter platform, and unlike Substack it will send from your own domain. Every publication starts on a free beehiiv subdomain, and beehiiv manages SPF, DKIM, and DMARC for mail sent from there; you do nothing and it authenticates as beehiiv. The moment you switch to a custom email sending domain, that job moves to your DNS. beehiiv's help center describes the email half as three CNAME records, “one for SPF and two for DKIM,” behind a domain ownership TXT, and once the domain verifies beehiiv rotates keys behind the CNAMEs without asking you again. Custom domains are listed on every beehiiv plan, the free Launch plan included.

One honest note on the record values. beehiiv does not publish the CNAME host names or targets anywhere in its documentation; they are generated per domain and shown only in the setup popup, and afterwards under View DNS Records. This page gives you the shape and the exact console path, and you copy the values from your own account.

Publish SPF and DKIM

Click Settings in the bottom left of the dashboard, pick the publication if you have several, then click Domains in the left panel. Under Connect to an Existing Website Domain, open the Set Up Custom Domain dropdown and choose Set up email custom domain (or web and email together). In Configure email domain select Enable a new domain or subdomain and enter a subdomain such as mail.yourdomain.com or news.yourdomain.com. beehiiv recommends a subdomain whenever the root domain is used for regular email, and warns Namecheap Private Email customers away from mail specifically. Review the summary and click Finish Set Up to generate the records.

You then pick Set up with Entri, which logs into a supported DNS provider and writes everything for you, or Set up Manually. Manual setup runs in three steps: an ownership TXT, then the Web, Redirect, and Email tabs of records, then the optional branded links. The Email tab is the part that matters here, and its shape is:

Type:  TXT     (domain ownership)
Host:  (the Name shown in Step 1 of the popup)
Value: (the Value shown in the popup)

Type:  CNAME   (SPF, via the bounce domain)
Host:  (the Name shown on the Email tab, under mail.yourdomain.com)
Value: (the target shown on the Email tab)

Type:  CNAME   (DKIM key 1)
Host:  (the Name shown on the Email tab)
Value: (the target shown on the Email tab)

Type:  CNAME   (DKIM key 2)
Host:  (the Name shown on the Email tab)
Value: (the target shown on the Email tab)

A CNAME cannot hold an SPF policy, so the record beehiiv labels SPF is a bounce host: it delegates a name under your sending domain to beehiiv's mail infrastructure, the Return-Path of every send lands on that name, and SPF is evaluated against beehiiv's published policy while still aligning with your domain. That is why there is no v=spf1 include: line to merge into your root record; do not invent one. Copy each Type, Name, and Value exactly, spacing and punctuation included, and enter only the host portion if your DNS provider appends the domain for you. On Cloudflare every record must be DNS Only, because a proxied record hides its value and beehiiv cannot see it. Click Verify on each tab. beehiiv says verification can take up to 72 hours, and asks you not to remove and re-add records in that window because it can trip a rate limit with its SSL provider. The whole setup, web plus email plus branded links, is 12 records; the email-only path is the four above.

Add DMARC

This one is not optional. Since February 2024 beehiiv has required every account on a custom domain to have a valid DMARC record, and its setup guide repeats it as a required step. Publish it at your root domain even when you send from mail.yourdomain.com; DMARC rolls down to subdomains, so one record covers the newsletter. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. beehiiv's own DMARC wizard produces the same _dmarc TXT and refuses beehiiv subdomains, since those are already covered. Two details from its FAQ are worth keeping: leave pct= off a p=none record, and choose relaxed alignment, which is the default and is what the subdomain setup relies on. If you want a different policy for subdomains than for the root, that is the sp= tag, not a second record.

The beehiiv gotcha

Verified is not In use. beehiiv's own troubleshooting note covers the case where the domain shows Verified and the newsletter still arrives from the beehiiv subdomain. On Settings > Domains the email domain has to show both Verified and In use; if it is only Verified, activate it as the sending domain, then allow up to 24 more hours of propagation. Until you do, your four records sit in DNS doing nothing and every send still authenticates as beehiiv. The related trap is the address itself: your sender and reply-to must be on the domain you authenticated. If the domain is mail.yourdomain.com, both addresses go on @mail.yourdomain.com, set under Settings > Emails > Sending Details. A From address on the root domain with DKIM signed by the subdomain still aligns under relaxed mode, but beehiiv tells you to match them, and mismatched reply-to domains are what its support sees flagged.

DKIM will read Not Found until mail flows. SPF and DMARC are static records and check immediately; beehiiv's DKIM status is tied to real traffic, so it shows Found only after you have sent a few messages from the domain. Send a test rather than re-adding the CNAMEs. And expect a slow start: every new custom sending domain goes through Smart Warming, which ramps volume over the first four to eight weeks, so a large list will be delivered in growing batches while the domain earns its reputation. Switching to another custom domain later restarts both the warming and the DMARC requirement.

Confirm it worked

• Check the Domains page. The email domain should read Live, with both Verified and In use. If a badge still says Action Required or Configuring Email after 72 hours, compare each Type, Name, and Value against View DNS Records from the three-dots menu, and check Cloudflare proxying before anything else.
• Send a test and read the headers. Send a post to a mailbox you control and confirm the From address is on mail.yourdomain.com, the DKIM signature shows d=mail.yourdomain.com, the Return-Path is under the same subdomain, and the result is dmarc=pass. Our header analyzer reads it back plainly. A signature on a beehiiv domain means the sending domain is not In use yet.
• Watch the reports. beehiiv should appear as an aligned, passing source on both SPF and DKIM in your DMARC aggregate reports, attributed to the sending subdomain and labeled as a known sender in trustyourinbox. Volume will climb over the Smart Warming weeks, so a small first week is expected.