Customer.io SPF and DKIM setup

What you are setting up

Customer.io sends your automated, broadcast, and transactional email. Unlike most senders, it does not touch your root domain at all. Everything it needs lives on an account-specific subdomain such as cio12345.yourdomain.com: an MX record that gives Customer.io a custom return path for bounces, an SPF record, and a DKIM key. Customer.io signs the return path, SPF, and DKIM with that subdomain, and your mail aligns to your root domain through DMARC’s default relaxed matching. The only record you add at the root is DMARC itself.

Publish SPF and DKIM

In Customer.io, go to Settings > Workspace Settings > Email and click Add Sending Domain. Enter the domain, a display name, and a From address (the From address is optional here but required before verification can finish), then click Show Records. Customer.io lists four records. Three go on the subdomain it assigns you:

Type:  MX
Host:  cio12345                    (your account-specific subdomain)
Value: the two hostnames Customer.io shows you, same priority

Type:  TXT     (SPF)
Host:  cio12345
Value: the v=spf1 record Customer.io shows you

Type:  TXT     (DKIM)
Host:  krs._domainkey.cio12345
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq... (the key Customer.io shows you)

The DKIM selector is krs and the host is krs._domainkey.cio12345.yourdomain.com, so the record sits under the subdomain, not under your root. The SPF record must be a TXT record, not the legacy SPF record type, and it goes on the subdomain, never merged into your existing root SPF. Because it is on its own subdomain it does not count against your root record’s ten-lookup limit. The MX record exists only so bounces return to Customer.io; it does not change where your inbound mail goes. When the records are in, click Verify domain. Verification can take up to 72 hours but is usually much faster. If your DNS is on Cloudflare or one of the 50-plus providers Entri supports, the Automatic setup option writes these records for you.

Add DMARC

The fourth record is DMARC, and it goes on your root domain, not on the Customer.io subdomain. Customer.io checks for it and requires at least p=none. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Customer.io gotcha

Strict alignment breaks every message. Customer.io signs with cio12345.yourdomain.com while your From address is yourdomain.com. That is a parent/child match, which passes under DMARC’s default relaxed mode but fails if your record says aspf=s or adkim=s. With a strict tag and p=reject your Customer.io mail bounces; with p=quarantine it lands in spam. Leave both tags out or set them to r. Two smaller traps: Customer.io only checks your records when you click Verify domain, so a record deleted later stops your sending silently until you re-verify, and hosts such as GoDaddy append your domain to the host name automatically, so enter cio12345 rather than the full cio12345.yourdomain.com or the record lands at cio12345.yourdomain.com.yourdomain.com. If you also want tracked links on your own subdomain, the Link Tracking tab gives you a CNAME to e.customeriomail.com (or e-eu.customeriomail.com for EU accounts); a domain with an HSTS policy needs the HTTPS link tracking setup instead.

Confirm it worked

• Verify in Customer.io. On the Sending domains page the domain should show Verified, with green checkmarks beside the MX, SPF, and DKIM records.
• Send a test and read the headers. Send through Customer.io, open the message, and confirm the DKIM signature shows d=cio12345.yourdomain.com with s=krs, and that the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Customer.io should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.