Emarsys SPF and DKIM setup

What you are setting up

SAP Emarsys sends your marketing and triggered email from a dedicated subdomain of your brand, something like email.yourdomain.com, never the apex. You publish an SPF record and two DKIM CNAMEs on that subdomain, plus a CNAME for a bounces subdomain beneath it, so Emarsys signs as you and both SPF and DKIM align. Emarsys can also host the subdomain for you if you delegate it with NS records to its nameservers (such as ns1.emarsys.net); this guide covers the self-managed records, which is what the validation tool checks.

Publish SPF and DKIM

In Emarsys, go to Management > Email Domain Validation, click Add Domain, and enter your sending subdomain and link domain. The DNS Settings step lists the records for your exact names (there is an Export DNS table button). Using email.yourdomain.com as the example, they are:

Type:  TXT     (SPF)
Host:  email.yourdomain.com
Value: v=spf1 include:spf.emarsys.net ~all

Type:  CNAME   (DKIM, first key)
Host:  key5._domainkey.email.yourdomain.com
Value: key5.dkim.emarsys.net

Type:  CNAME   (DKIM, second key)
Host:  key6._domainkey.email.yourdomain.com
Value: key6.dkim.emarsys.net

Type:  CNAME   (bounce / return-path domain)
Host:  bounces.email.yourdomain.com
Value: bounces.emarsys.net

The DKIM records are CNAMEs to keys Emarsys hosts, which is how it rotates 2048-bit keys for you without a DNS change on your side; the validator expects both key5 and key6. The SPF include is a single lookup. If you use Emarsys Reply Management to receive replies, add an MX record on the sending subdomain pointing at mx.eemms.net; if you host replies yourself, use your own MX and make sure the mailbox actually exists. Then click Start validation (it takes a few minutes, and the result lands in the Notification Center). For a brand-new sending or link domain you also open a support ticket with a screenshot of the passing validation before Emarsys enables sending on it.

Add DMARC

Emarsys recommends a strict-DKIM record straight away, but start in monitor-only mode and ramp up once your reports are clean. Publish it on the sending subdomain (and on your apex, which covers every subdomain without its own record):

Type:  TXT
Host:  _dmarc.email.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none when you are ready. Emarsys's own recommendation is p=reject; adkim=s; aspf=r, and its validator warns on anything short of reject, so treat that as the destination, not the first step.

The Emarsys gotcha

The bounce domain decides whether SPF aligns. If your account still uses a shared Emarsys bounce domain (a generic name like xpressus.emsmtp.us), SPF passes for Emarsys but does not align to your domain, so only DKIM carries DMARC, and Google and Yahoo count spam complaints against a return-path shared with hundreds of other senders. Publish the bounces.email.yourdomain.com CNAME so the return-path is yours. The second trap is legacy records: setups from before July 2022 use an older two-lookup SPF include, older DKIM selectors, and different MX hosts. Add the new records alongside the old ones, do not delete the old DKIM record until Emarsys support confirms the switch, and only then remove it. And never put any of this on the apex; Emarsys sends from the subdomain, so the records live there.

Confirm it worked

• Validate in Emarsys. Each domain on the Email Domain Validation page should show Success, and the Domain and DNS Information view shows BOUNCE, SPF, MX, DKIM, DMARC, and CNAME each as valid.
• Send a test and read the headers. Send a test campaign to a Gmail address, open Show original, and confirm the DKIM signature shows d=email.yourdomain.com, the return-path is on your bounces subdomain, and you see dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Emarsys should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox, with the subdomain it sends from broken out in the subdomain view.