Front SPF and DKIM setup

First: which Front channel are you using?

Front is a shared inbox, and only some channels need DNS setup. Figure out yours before you touch DNS:

• Generic SMTP forwarding channel (you forward a custom address into Front and Front sends on your behalf): this is the one that needs SPF and DKIM, and it is what this page covers.
• Gmail or Microsoft 365 sync channel: Front sends through the Google or Microsoft APIs directly, so you do not configure SPF/DKIM in Front; set those up with Google Workspace or Microsoft 365 instead. A Gmail, Office 365, or Google Groups channel set up with SMTP forwarding is the forwarding case above and does need the records.
• Custom SMTP channel (your own mail server): deliverability is your server's job. Front recommends this for domains hosted at DreamHost, HostGator, SiteGround, and Wix, which cannot create the MX record Front needs.

Publish the records Front shows you

For a generic SMTP forwarding channel, open company settings > Security > Deliverability (company admins only; the tab appears once a shared SMTP channel exists, and an individual SMTP channel is configured from that teammate's Channels settings instead) and select your domain. Front shows you three records to publish, an MX record plus SPF and DKIM records:

Type:  MX / TXT / ...   (Front lists the exact set for your domain)
Host:  front-mail        (example host; enter just the label, not the full domain)
Value: (copy the exact values Front shows you)

Copy the records exactly from the Deliverability panel. Front deliberately does not publish fixed values, because they are specific to your domain, and its own setup screens warn that the examples you see in docs will differ from your real values. Enter the host as just the label (for example front-mail), not front-mail.yourdomain.com, or a provider that auto-appends your domain will double it.

Use relaxed DMARC alignment

This is the Front-specific rule worth knowing. Front's SMTP channels fail strict SPF alignment, but DMARC's relaxed alignment works with Front. So your DMARC record should use relaxed alignment (which is the default if you do not set aspf):

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; aspf=r; adkim=r; rua=mailto:dmarc@yourdomain.com

Do not publish a strict-alignment policy (aspf=s) on a domain you send Front mail from, or that mail will fail DMARC. If your domain already has a strict DMARC policy, check with whoever owns it before pointing a Front channel at it. Build the record with our DMARC builder and progress past p=none when reports are clean.

The Front gotcha

The trap unique to Front is the strict-alignment failure above: a domain already locked to aspf=s will reject Front's mail at DMARC even though the records are published correctly, because Front's SPF aligns only in relaxed mode. The fix is the relaxed policy, not more DNS records. Second, if you skip the records entirely, recipients see a “via sendgrid.net” notice next to your address and your deliverability suffers, so finish the full set.

Confirm it worked

• Verify in Front. The Deliverability panel should clear its warning icon for the domain once the records resolve.
• Send a test and read the headers. Send from your Front channel, open the original, and confirm dmarc=pass (and no “via” notice). Our header analyzer reads it back plainly.
• Watch the reports. Front should appear as a passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.