Front SPF and DKIM setup

First: which Front channel are you using?

Front is a shared inbox, and only some channels need DNS setup. Figure out yours before you touch DNS:

• Generic SMTP forwarding channel (you forward a custom address into Front and Front sends on your behalf): this is the one that needs SPF and DKIM, and it is what this page covers.
• Gmail or Microsoft 365 sync channel: Front sends through Google or Microsoft directly, so you do not configure SPF/DKIM in Front, set those up with Google Workspace or Microsoft 365 instead.
• Custom SMTP channel(your own mail server): deliverability is your server's job. Front recommends this for Yahoo, Hotmail, and iCloud addresses.

Publish the records Front shows you

For a generic SMTP forwarding channel, open company settings > Security > Deliverability(or the channel's own Settings, under “Improve delivery rates”) and select your domain. Front shows you a set of records to publish, an MX record plus SPF and DKIM records:

Type:  MX / TXT / ...   (Front lists the exact set for your domain)
Host:  front-mail        (example host; enter just the label, not the full domain)
Value: (copy the exact values Front shows you)

Copy the records exactly from the Deliverability panel. Front deliberately does not publish fixed values, because they are specific to your domain, and its own setup screens warn that the examples you see in docs will differ from your real values. Enter the host as just the label (for example front-mail), not front-mail.yourdomain.com, or a host that auto-appends your domain will double it.

Use relaxed DMARC alignment

This is the Front-specific rule worth knowing. Front's SMTP channels fail strict SPF alignment, but DMARC's relaxed alignment works with Front. So your DMARC record should use relaxed alignment (which is the default if you do not set aspf):

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; aspf=r; adkim=r; rua=mailto:dmarc@yourdomain.com

Do not publish a strict-alignment policy (aspf=s) on a domain you send Front mail from, or that mail will fail DMARC. If your domain already has a strict DMARC policy, check with whoever owns it before pointing a Front channel at it. Build the record with our DMARC builder and progress past p=none when reports are clean.

The Front gotcha

The trap unique to Front is the strict-alignment failure above: a domain already locked to aspf=swill reject Front's mail at DMARC even though the records are published correctly, because Front's SPF aligns only in relaxed mode. The fix is the relaxed policy, not more DNS records. Second, if you skip the records entirely, recipients see a “via” notice from Front's mail provider and your deliverability suffers, so finish the full set.

Confirm it worked

• Verify in Front. The Deliverability panel should clear its warning icon for the domain once the records resolve.
• Send a test and read the headers. Send from your Front channel, open the original, and confirm dmarc=pass (and no “via” notice). Our header analyzer reads it back plainly.
• Watch the reports. Front should appear as a passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.