beehiiv SPF and DKIM setup

What you are setting up

beehiiv is a newsletter platform, and unlike Substack it will send from your own domain. Every publication starts on a free beehiiv subdomain, and beehiiv manages SPF, DKIM, and DMARC for mail sent from there; you do nothing and it authenticates as beehiiv. The moment you switch to a custom email sending domain, that job moves to your DNS. beehiiv's help center describes the email half as three CNAME records, “one for SPF and two for DKIM,” behind a domain ownership record, and once the domain verifies beehiiv rotates keys behind the CNAMEs without asking you again. beehiiv lists custom domains as a paid-plan feature.

One note on the record values. beehiiv does not publish the CNAME host names or targets anywhere in its documentation; they are generated per domain and shown only in the setup flow and afterwards on the Domains page. This page gives you the shape and the exact console path, and you copy the values from your own account.

Publish SPF and DKIM

Click Settings in the bottom left of the dashboard, pick the publication if you have several, then click Domains in the left panel and choose Set up custom domain. beehiiv asks what you want to set up: Host my website, Send my newsletters, or Set up both. Pick the newsletter option (or both) and enter an email domain or subdomain such as mail.yourdomain.com or news.yourdomain.com. beehiiv's advice is “use a subdomain when you can,” because it is simpler to verify and secure than a root domain and keeps the newsletter apart from your regular mail.

You then pick Automatically set it up for me, which signs in to a supported DNS provider through Entri and writes the records for you (and skips the ownership step), or I'll add the records myself. Manual setup starts with a record that proves you own the domain, then shows the records for whatever you chose to set up; the email records are the part that matters here, and their shape is:

Type:  (as shown)   (domain ownership)
Host:  (the Name beehiiv shows)
Value: (the Value beehiiv shows)

Type:  CNAME   (SPF, via the bounce domain)
Host:  (the Name shown, under mail.yourdomain.com)
Value: (the target shown)

Type:  CNAME   (DKIM key 1)
Host:  (the Name shown)
Value: (the target shown)

Type:  CNAME   (DKIM key 2)
Host:  (the Name shown)
Value: (the target shown)

A CNAME cannot hold an SPF policy, so the record beehiiv labels SPF is a bounce host: it delegates a name under your sending domain to beehiiv's mail infrastructure, the Return-Path of every send lands on that name, and SPF is evaluated against beehiiv's published policy while still aligning with your domain. That is why there is no v=spf1 include: line to merge into your root record; do not invent one. Copy each Type, Name, and Value exactly, spacing and punctuation included, and enter only the host portion if your DNS provider appends the domain for you. On Cloudflare every record must be DNS only, because a proxied record hides its value and beehiiv cannot see it. beehiiv says verification usually takes a few hours and can take up to 72, and that the full setup for web, email and branded links comes to 12 records; the email-only path is the four above. Leave the records in place once they are live: beehiiv removes a domain whose SSL renewal fails for more than seven days, which it says usually happens when the linking DNS records were removed.

Add DMARC

This one is not optional. Since February 2024 beehiiv has required every account on a custom domain to have a valid DMARC record, and its setup guide repeats it as a required step. Publish it at your root domain even when you send from mail.yourdomain.com; DMARC rolls down to subdomains, so one record covers the newsletter. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. beehiiv's own DMARC wizard produces the same _dmarc TXT and refuses beehiiv subdomains, since those are already covered. Two details from its FAQ are worth keeping: keep the percentage blank on a p=none record, and choose relaxed alignment, which is the default and is what the subdomain setup relies on. If you want a different policy for subdomains than for the root, that is the sp= tag, not a second record.

The beehiiv gotcha

Verified is not in use. On Settings > Domains beehiiv marks verified domains with a green check and separately marks the ones “in use,” and its guide says to wait until every item for the domain shows Live before sending from it. A domain that is verified but not the one in use keeps sending from the beehiiv subdomain: your four records sit in DNS doing nothing and every send still authenticates as beehiiv. beehiiv says a new DNS setting can take up to 24 hours to propagate, during which the status may read “Verifying Configuration.” The related trap is the address itself: the sending address is the part before the @ you type under Sending address, right after the email domain field in Set up custom domain, so it always sits on the domain you authenticated (Settings > Email > Email sending details sets the sender name, not the address). If the domain is mail.yourdomain.com, your mail goes out from an address on @mail.yourdomain.com, and the DKIM signature on that subdomain aligns with it.

Expect a slow start. Every new custom sending domain goes through Smart Warming, which ramps volume over the first weeks so the domain earns its reputation; beehiiv says it typically takes six to eight weeks for publications that send more than once a week, longer for less frequent senders, and that it starts once the list passes 100 subscribers (200 if the domain was connected before that). A large list is sent in growing batches in that window, so do not read a small first week as a DNS problem. Send a test rather than re-adding the CNAMEs.

Confirm it worked

• Check the Domains page. Every item for the email domain should read Live, and the domain should be the one marked in use. If it is still in progress after 72 hours, compare each Type, Name, and Value against what beehiiv shows for the domain, and check Cloudflare proxying before anything else.
• Send a test and read the headers. Send a post to a mailbox you control and confirm the From address is on mail.yourdomain.com, the DKIM signature shows d=mail.yourdomain.com, the Return-Path is under the same subdomain, and the result is dmarc=pass. Our header analyzer reads it back plainly. A signature on a beehiiv domain means the sending domain is not the one in use yet.
• Watch the reports. beehiiv should appear as an aligned, passing source on both SPF and DKIM in your DMARC aggregate reports, attributed to the sending subdomain and listed as an identified sender in trustyourinbox. Volume will climb over the Smart Warming weeks, so a small first week is expected.