Ghost SPF and DKIM setup

What you are setting up

Ghost is a publishing platform with newsletters built in, and it comes in two forms that authenticate differently. On Ghost(Pro), Ghost's hosted service, email delivery is included and, in Ghost's words, “the configuration is handled for you automatically.” Out of the box that means newsletters leave from Ghost's own ghost.io sending domain and your DNS is not involved at all. A custom sending domain moves that onto your domain: you publish the authentication records Ghost hands you, and newsletters and member emails go out signed as you. On self-hosted Ghost, Mailgun is the only supported bulk email provider, so the records are Mailgun's and you publish them on the Mailgun sending domain yourself. Both paths end in the same place: a DKIM signature and an SPF-passing Return-Path on your domain, plus a DMARC record, which Ghost(Pro) requires rather than merely recommends.

Publish SPF and DKIM

On Ghost(Pro). Custom sending domains are only supported on the Publisher plan or higher, and only once a custom domain is connected to the publication. In Ghost Admin, go to Ghost(Pro) > Domain and click Setup in the Custom sending domain section. Ghost then lists the DNS records to create with your domain provider, each copyable straight from the admin. Ghost does not publish that record list in its help center, so we will not guess at hostnames here; copy exactly what your Ghost Admin shows, add the DMARC record below, and click Activate. A green check means Ghost detected the record and a red mark means it has not yet; Ghost says propagation “can take anywhere between 15 minutes to 24 hours to fully resolve.”

On self-hosted Ghost. Ghost's config docs cover transactional mail (the mail block, with transport set to SMTP and a real from address), and newsletters are configured from the Email newsletter settings in Ghost Admin by entering your Mailgun domain and API key. The domain you enter is the one you authenticate in Mailgun, by convention a subdomain such as mail.yourdomain.com. On that subdomain, publish:

Type:  TXT     (SPF)
Host:  mail.yourdomain.com
Value: v=spf1 include:mailgun.org ~all

Type:  TXT     (DKIM, the common setup)
Host:  mx._domainkey.mail.yourdomain.com
Value: k=rsa; p=MIGfMA0GCSq... (the key Mailgun shows you)

Type:  CNAME   (open and click tracking)
Host:  email.mail.yourdomain.com
Value: mailgun.org        (EU region: eu.mailgun.org)

Newer Mailgun domains on Automatic Sender Security show two CNAMEs at pdk1._domainkey and pdk2._domainkey instead of the TXT key; publish whichever pair Mailgun shows you. The full walk-through, including the EU differences and the MX records you can skip, is in our Mailgun guide. Then set each newsletter's sender address, under Settings > Newsletters, to a mailbox on that domain or its root, and click the verification link Ghost emails to it. Ghost will not send from a sender address until that link has been clicked.

Add DMARC

On Ghost(Pro) this is not optional: “Setting up a DMARC policy record on your domain is required for using a custom sending domain on Ghost.” The example in Ghost's help center is the bare minimum, v=DMARC1; p=none; with no reporting address. Add one, or you will never see a report:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Ghost accepts any of the three policies; start at p=none and let the warm-up below finish before you tighten it.

The Ghost gotcha

The six-week warm-up hides most of your newsletter volume. Ghost does not switch a new sending domain on all at once. It warms the domain's reputation by using it for a fraction of recipients first, over roughly six weeks, and until then “some recipients will receive newsletter emails from the ghost.io sending domain.” Those messages carry Ghost's domain, not yours, so they never appear in your DMARC reports at all. For the first weeks your reports will show a small, growing slice of your real send volume, and that is expected rather than a broken setup. Do not judge alignment, and above all do not move to p=reject, until the warm-up is complete and your whole newsletter volume is showing up aligned. Transactional mail (sign-in links, receipts) uses your sending domain right away, so early reports are mostly that.

On self-hosted Ghost, the sender address has to match the Mailgun domain. Authenticate mail.yourdomain.com in Mailgun and then set a newsletter sender on some other domain, and the DKIM signature is on Mailgun's subdomain while the From is elsewhere, so DMARC does not align. Ghost's sender verification link only proves you can read that mailbox; it says nothing about alignment. Keep the From on the authenticated subdomain or its root.

Confirm it worked

• Check the admin. On Ghost(Pro), the Custom sending domain section shows a green check against every record once Ghost detects them. On a self-hosted site, the domain's DNS page in Mailgun turns green.
• Send a test and read the headers. Send a test newsletter to yourself, open it, and confirm the DKIM signature shows d=yourdomain.com with dmarc=pass. Our header analyzer reads it back plainly. If the signing domain is ghost.io during the first weeks on Ghost(Pro), you landed in the not-yet-warmed fraction; try again.
• Watch the reports. Your newsletter source should appear as an aligned, passing source in your DMARC aggregate reports and grow toward your full send volume as the warm-up completes. trustyourinbox labels it as a known sender.