Bird SPF and DKIM setup

What you are setting up

Bird (formerly MessageBird, which also absorbed SparkPost) sends your transactional and marketing email from bird.com. You authenticate a sending domain with two required records, a DKIM TXT and a return-path CNAME, plus a DMARC record that Bird treats as a hard requirement before it will verify the domain. There is no SPF include to add at your apex: the return-path CNAME carries SPF, and because the return-path is a subdomain of your domain, SPF aligns too.

Publish SPF and DKIM

In Bird, go to Email > Domains and add your sending domain. Bird generates a DKIM selector and key for your organization and shows you the records to publish:

Type:  TXT     (DKIM)
Host:  <selector>._domainkey       (the selector Bird shows you)
Value: v=DKIM1; k=rsa; p=MIGf... (the key Bird shows you)

Type:  CNAME   (return-path, carries SPF)
Host:  send                        (send.yourdomain.com, the default; you can rename it)
Value: <region>.bounce.bird.com    (the exact host Bird shows you, us1 or eu1)

Type:  CNAME   (tracking, optional)
Host:  links                       (links.yourdomain.com, the default; you can rename it)
Value: <region>.links.bird.com

The selector and key are unique to your organization, so copy the exact host and value from the dashboard rather than constructing them by hand. Your envelope-from becomes send.yourdomain.com, and the CNAME points it at Bird's bounce infrastructure, which already publishes SPF. The SPF lookup follows the CNAME, so SPF passes and aligns with no change to your apex record. The tracking CNAME is optional; it gives you branded open and click links served over HTTPS once it verifies.

Add DMARC

Bird requires a valid v=DMARC1 policy on the sending domain (or its organizational domain) before the domain verifies. A minimal p=none is enough, and Bird suggests its own reporting address; use yours if you monitor elsewhere:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Bird gotcha

Do not go looking for a Bird SPF include. Bird deliberately keeps SPF off your apex, and the dashboard will never ask for one. Teams migrating from SparkPost or MessageBird often leave a legacy include: in place or hunt for a new one to add, which only spends lookups against the 10-lookup limit and authorizes nothing extra. The return-path CNAME is the whole SPF story. The second trap is regions: Bird domains are registered per region, us1 and eu1, each with its own DKIM selector and its own bounce host. If you send from both, verify the domain in both and publish both sets of records. Finally, Bird re-checks every domain daily and only drops verification after two consecutive failed checks, so a domain that quietly lost its records will still show verified for a day before it fails.

Confirm it worked

• Watch the domain verify. Bird checks the records immediately, backing off from every couple of minutes to hourly over the first three days, so it should flip to verified within minutes of the DNS resolving.
• Send a test and read the headers. Send through Bird, open the message, and confirm the DKIM signature shows d=yourdomain.com, the Return-Path is on send.yourdomain.com, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Bird should appear as an aligned, passing source in your DMARC aggregate reports, with both SPF and DKIM aligned, labeled as a known sender in trustyourinbox.