DocuSign SPF and DKIM setup

What you are setting up

Out of the box, DocuSign sends every envelope notification from its own address, for example dse@docusign.net (or dse-demo@docusign.net in the demo environment). That mail authenticates as DocuSign, not as you, so it never shows up as an aligned sender for your domain and your recipients see a stranger in the From line. The fix is DocuSign’s Custom Email Domain feature: you claim your top-level domain, DocuSign creates a dedicated subdomain (for example docusign.yourdomain.com), and you publish the DKIM, SPF, and MX records it hands you. Once verified, notifications go out as [username]@docusign.yourdomain.com, DKIM-signed and aligned to your domain.

Publish SPF and DKIM

You need to be an organization administrator in DocuSign Admin, and the Custom Email Domain feature only exists with the Access Management with SSO add-on. There are two DNS stages.

Stage 1: claim the top-level domain. From the Organization view, open Domains and claim yourdomain.com. DocuSign generates a verification token and lets you publish it as either a CNAME or a TXT record; DocuSign recommends the CNAME. A domain can only be claimed by one DocuSign organization, though the same organization can claim it in both demo and production.

Stage 2: add the custom email subdomain. From the Organization view, select Features, scroll to Custom Email Domain, select Manage, then Actions > Enable. A Custom Email Domain item appears in the Admin menu. Open it, select Add Subdomain, type the subdomain label (DocuSign’s own example is docusign), pick your verified top-level domain, and select Next. DocuSign then shows four records to create on that subdomain:

Type:  CNAME   (DKIM key 1)     the host and target DocuSign shows you
Type:  CNAME   (DKIM key 2)     the host and target DocuSign shows you
Type:  TXT     (SPF)            the value DocuSign shows you
Type:  MX                       the host and mail server DocuSign shows you

The hostnames, CNAME targets, SPF value, and MX target are generated per organization, so copy them exactly from the DocuSign screen rather than from a guide. Because they all live on the new subdomain, they do not touch the SPF record on your apex domain, and there is no include: to merge there. Select Verify DNS Now when the records are in, or Save Domain and Verify DNS Later if your DNS host is still propagating; DocuSign allows up to 24 hours.

Finally, add the address DocuSign will send from: in the verified subdomain, select Actions > Add email address, set the From display name and address, set a reply-to (this one does not need to use the subdomain, so an existing alias or a no-reply address works), link one or more accounts, and save. DocuSign says the change can take up to 60 minutes to apply.

Add DMARC

Standard _dmarc TXT record on your top-level domain, nothing DocuSign-specific. The subdomain inherits it. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The DocuSign gotcha

The feature is gated, and it only fixes the From address. If you cannot find Custom Email Domain under Features, you do not have the Access Management with SSO add-on, and no amount of DNS work will make DocuSign sign as your domain; until then, every notification stays on dse@docusign.net and shows in your DMARC reports as DocuSign’s domain, not yours. Two more things trip people up. The subdomain must be new: DocuSign creates it during verification, will not reuse an existing one, and refuses any subdomain already used for SSO. And the claim step is separate from the subdomain step, so a verified top-level domain is a prerequisite, not the finish line. The usual DNS-host pitfall applies too: enter only the host portion DocuSign gives you, or your provider appends the domain twice.

Confirm it worked

• Verify in DocuSign Admin. The subdomain should show as verified under Custom Email Domain once the four records resolve.
• Send a test envelope and read the headers. Open the notification email, confirm the From address is on your subdomain, and check that the DKIM signature carries your domain and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. DocuSign should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.