Benchmark Email SPF and DKIM setup

What you are setting up

Benchmark Email is a newsletter and marketing automation platform aimed at small businesses. Its domain authentication is a pair of CNAME records, one for SPF and one for DKIM, generated for your account under Domain Authentication. Benchmark used to hand out an SPF TXT record; it has since moved SPF to a CNAME as well, and its help center now says that for both SPF and DKIM the record type is CNAME. Because the CNAMEs point into Benchmark's infrastructure, Benchmark holds the keys and can rotate them without you touching DNS. The third requirement is the one that surprises people: Benchmark also expects at least one valid DMARC record on the domain before it considers authentication complete.

The stakes are unusually visible with this vendor. If you send without authenticating, Benchmark does not simply sign with its own domain; it rewrites your From address. Benchmark's own example: a campaign from sales@companyname.com arrives as sales.yourcompanyname.com@123456.clients.bmsend.com. Your recipients see a Benchmark address, your domain never enters the DMARC picture, and the mail will not appear in your aggregate reports at all.

Publish SPF and DKIM

In Benchmark Email, click your account name and select Account Settings, then Domain Authentication. The page lists the domains from your verified From addresses. Select the one you want, click Start, and confirm with Start Authentication. Benchmark says the records can take up to 30 minutes to generate; when they are ready, click View to see them. Copy each one into your DNS as a new record. The shape is:

Type:  CNAME   (SPF)
Host:  (the host shown on the View screen)
Value: (the target shown on the View screen, on bmsend.com)

Type:  CNAME   (DKIM)
Host:  (the selector shown on the View screen)._domainkey
Value: (the target shown on the View screen, on bmsend.com)

The exact host names and targets are not published in Benchmark's help center; they are unique to your account and only appear on the View screen, so copy them from there rather than from any guide, including this one. Your DNS host may label the two fields differently (Host, Alias, Name, Subdomain, or Prefix for the host; Target, Destination, Points To, or Address for the value); Benchmark lists those synonyms in its guide. If your host appends the domain automatically, enter only the part before your domain.

If you set Benchmark up years ago, your zone probably still carries the old SPF TXT record Benchmark used to hand out. Benchmark says that record may now show as invalid on the authentication page, and the fix is to replace it with the new SPF CNAME. Keep any other includes you have (Google Workspace, Microsoft 365) in your one remaining SPF TXT record. When you are done, Benchmark's checklist is two Benchmark CNAME records and a valid DMARC record. Click Check Configuration; Benchmark says the result can take a few minutes to appear and DNS may take up to 48 hours to propagate, so refresh rather than re-adding records.

Add DMARC

With Benchmark this step is not optional: the Domain Authentication page checks for at least one valid DMARC record and will not show a full Success without one. A safe record that satisfies the check, and the one Benchmark's own email-authentication guide (published on its BenchmarkONE help center) uses as its example, is:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; adkim=r; aspf=r

Add a reporting address so the record actually tells you something: v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:dmarc@yourdomain.com. Build it with our DMARC builder and progress past p=none once your reports are clean. If your domain already has a valid DMARC record, Benchmark shows a green check next to it and tells you not to add another; if it is misconfigured, Benchmark shows your existing value and a suggested correction. Two _dmarc records is an error. One point worth repeating: unlike the SPF and DKIM records on the authentication page, a DMARC record affects every sender on your domain, not just Benchmark mail.

The Benchmark Email gotcha

Relaxed alignment is a requirement, not a suggestion. Benchmark's email-authentication guide says to make sure aspf and adkim are not set to strict. The CNAMEs delegate hosts under your domain to Benchmark's infrastructure, so the signing domain and the return-path domain can be children of your domain rather than the domain itself. Relaxed mode (the default) accepts that; adkim=s or aspf=s can fail it, and a strict record that another tool talked you into will quietly push authenticated Benchmark mail into DMARC failure.

The records are not copyable from a guide. Most vendors publish fixed CNAME targets you can type from memory. Benchmark does not; the SPF and DKIM hosts are account-specific and live only on the View screen. If you manage several client accounts, do not assume the second one matches the first. Two smaller ones: Benchmark recommends sending marketing from a subdomain (such as news.yourdomain.com) so campaign reputation stays off your main domain, which means authenticating that subdomain, not the apex; and a From address on Gmail, Yahoo, or another public mailbox can never be authenticated here at all, which Benchmark warns can land those campaigns in spam.

Confirm it worked

• Check the Domain Authentication page. Each of the three items (SPF CNAME, DKIM CNAME, DMARC) should show Success after Check Configuration. If one lags, wait for propagation and refresh; if it still fails, compare the host and value character by character against the View screen.
• Send a test and read the headers. Send a campaign test to yourself and confirm the From address is still you@yourdomain.com, not a clients.bmsend.com rewrite, and that the DKIM signature shows d= on your domain (or a subdomain of it) with dmarc=pass. Our header analyzer reads it back plainly. A signature with d=bmsend.com means the message was signed by Benchmark's domain, not yours, which Benchmark says is what happens without a DKIM or DMARC record of your own.
• Watch the reports. Benchmark Email should appear as an aligned, passing source in your DMARC aggregate reports, listed as an identified sender in trustyourinbox. If Benchmark volume is missing entirely, the campaigns are still going out rewritten and your domain was never in the From header.