Benchmark Email SPF and DKIM setup

What you are setting up

Benchmark Email is a newsletter and marketing automation platform aimed at small businesses. Its domain authentication is a pair of CNAME records, one for SPF and one for DKIM, generated for your account under Domain Authentication. Benchmark used to hand out an SPF TXT record with include:bmsend.com; it has since moved SPF to a CNAME as well, and its help center now says that for both SPF and DKIM the record type is CNAME. Because the CNAMEs point into Benchmark's infrastructure, Benchmark holds the keys and can rotate them without you touching DNS. The third requirement is the one that surprises people: Benchmark also expects at least one valid DMARC record on the domain before it considers authentication complete.

The stakes are unusually visible with this vendor. If you send without authenticating, Benchmark does not simply sign with its own domain; it rewrites your From address. Benchmark's own example: a campaign from sales@companyname.com arrives as sales.yourcompanyname.com@123456.clients.bmsend.com. Your recipients see a Benchmark address, your domain never enters the DMARC picture, and the mail will not appear in your aggregate reports at all.

Publish SPF and DKIM

In Benchmark Email, click your account name and select Account Settings, then Domain Authentication. The page lists the domains from your verified From addresses. Select the one you want, click Start, and confirm with Start Authentication. Benchmark says the records can take up to 30 minutes to generate; when they are ready, click View to see them. Copy each one into your DNS as a new record. The shape is:

Type:  CNAME   (SPF)
Host:  (the host shown on the View screen)
Value: (the target shown on the View screen, on bmsend.com)

Type:  CNAME   (DKIM)
Host:  (the selector shown on the View screen)._domainkey
Value: (the target shown on the View screen, on bmsend.com)

The exact host names and targets are not published in Benchmark's help center; they are unique to your account and only appear on the View screen, so copy them from there rather than from any guide, including this one. For reference, Benchmark's older material used the DKIM selector bmdeda, with bmdeda._domainkey.yourdomain.com pointing at bmdeda._domainkey.bmsend.com; your account may show something different, and the View screen wins. Your DNS host may label the two fields differently (Host, Alias, Name, or Prefix for the host; Target, Destination, or Points To for the value); Benchmark lists those synonyms because that mismatch is its most common support question. If your host appends the domain automatically, enter only the part before your domain.

If you set Benchmark up years ago, your zone probably still carries the old SPF TXT record with include:bmsend.com. Benchmark says that record may now show as invalid on the authentication page, and the fix is to replace it with the new SPF CNAME. Keep any other includes you have (Google Workspace, Microsoft 365) in your one remaining SPF TXT record. When you are done, Benchmark's checklist is two Benchmark CNAME records and a valid DMARC record. Click Check Configuration; Benchmark says the result can take a few minutes to appear and DNS may take up to 48 hours to propagate, so refresh rather than re-adding records.

Add DMARC

With Benchmark this step is not optional: the Domain Authentication page checks for a DMARC record and will not show a full Success without one. Benchmark's suggested record is:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; adkim=r; aspf=r

Add a reporting address so the record actually tells you something: v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:dmarc@yourdomain.com. Build it with our DMARC builder and progress past p=none once your reports are clean. If your domain already has a valid DMARC record, Benchmark shows a green check next to it and tells you not to add another; two _dmarc records is an error. Benchmark also makes a point worth repeating: unlike the SPF and DKIM records on its authentication page, a DMARC record affects every sender on your domain, not just Benchmark mail.

The Benchmark Email gotcha

Relaxed alignment is a requirement, not a suggestion. Benchmark's preparation guide says to make sure aspf and adkim are not set to strict. That is because Benchmark aligns on a subdomain: the CNAMEs delegate hosts under your domain to bmsend.com, so the DKIM signing domain and the SPF domain are children of your domain rather than the domain itself. Relaxed mode (the default) accepts that; adkim=s or aspf=s fails it, and a strict record that another tool talked you into will quietly push authenticated Benchmark mail into DMARC failure.

The records are not copyable from a guide. Most vendors publish fixed CNAME targets you can type from memory. Benchmark does not; the SPF and DKIM hosts are account-specific and live only on the View screen. If you manage several client accounts, do not assume the second one matches the first. Two smaller ones: Benchmark recommends sending marketing from a subdomain (such as news.yourdomain.com) so campaign reputation stays off your main domain, which means authenticating that subdomain, not the apex; and a From address on Gmail, Yahoo, or another public mailbox can never be authenticated here at all, so those campaigns always go out rewritten to clients.bmsend.com.

Confirm it worked

• Check the Domain Authentication page. Each of the three items (SPF CNAME, DKIM CNAME, DMARC) should show Success after Check Configuration. If one lags, wait for propagation and refresh; if it still fails, compare the host and value character by character against the View screen.
• Send a test and read the headers. Send a campaign test to yourself and confirm the From address is still you@yourdomain.com, not a clients.bmsend.com rewrite, and that the DKIM signature shows d= on your domain (or a subdomain of it) with dmarc=pass. Our header analyzer reads it back plainly. A “via bmsend.com” tag in the mail client means the message was signed by Benchmark's domain, not yours.
• Watch the reports. Benchmark Email should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. If Benchmark volume is missing entirely, the campaigns are still going out rewritten and your domain was never in the From header.