Greenhouse SPF and DKIM setup

What you are setting up

Greenhouse Recruiting sends your candidate email (interview invites, rejections, offer follow-ups) through Mailgun. Until you verify your domain, that mail goes out through outbound-mail.greenhouse.io and shows a “via greenhouse.io” flag next to the sender, which inbox providers treat with suspicion. Verifying the domain means publishing the SPF and DKIM records Greenhouse generates for you, plus an MX record, so recruiters' mail authenticates as yours. The part that surprises people is that Greenhouse does not put these records on your root domain. It puts them on a gh-mail subdomain it adds for you.

Publish SPF and DKIM

A Site Admin (with the “Can configure email settings” permission) goes to Configure > Dev Center > Email Settings, enters the email domain (the part after the @, no https:// or www) and clicks Register. Greenhouse prefixes gh-mail. to what you typed and generates a table with Type, Priority, Hostname, Required Value columns. Add every row at your DNS host. The shape looks like this; the values are unique to your account, so copy them from the console rather than from here:

Type:  TXT     (SPF)
Host:  gh-mail.yourdomain.com
Value: v=spf1 ... (the record Greenhouse shows you)

Type:  TXT     (DKIM)
Host:  <selector>._domainkey.gh-mail.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBg... (the key Greenhouse shows you)

Type:  MX
Host:  gh-mail.yourdomain.com
Value: (the mail exchanger and priority Greenhouse shows you)

Type:  CNAME   (optional, open tracking for Greenhouse support)
Host:  (the hostname Greenhouse shows you)

Both the SPF and DKIM rows must be type TXT; a DNS host that offers a legacy “SPF” record type will not verify. The MX record is not optional even though nothing receives mail there: the gh-mail subdomain is brand new, so it has no MX record of its own, and receivers treat a sending domain with no MX as spam. The DKIM key is 2048-bit by default, about 392 characters. If your DNS host caps a TXT value at 255 characters (Greenhouse names AWS Route 53), tick Use shorter DKIM key when you register instead of hand-splitting the string. The console has an Email Your I.T. Dept button that mails the rows to whoever runs your DNS.

Add DMARC

Standard _dmarc TXT record on your root domain, nothing Greenhouse-specific. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Leave alignment at the default relaxed mode (no aspf=s or adkim=s) unless you have read the next section. Build the record with our DMARC builder and progress past p=none once your reports are clean.

The Greenhouse gotcha

The gh-mail subdomain only aligns in relaxed mode. Greenhouse adds the subdomain for three sensible reasons: your root domain may already be registered with Mailgun, its SPF record may already be at the 10-lookup limit, and many IT teams will not touch root-domain DNS for a recruiting tool. Your recruiters still send from their normal addresses; gh-mail appears only on the envelope. Under DMARC's default relaxed alignment a subdomain of your domain counts as aligned, so this passes. But if your policy carries aspf=s or adkim=s, the subdomain no longer matches your From domain and every candidate email fails DMARC even though you followed every step. Greenhouse's own answer for strict policies is to remove the gh-mail entry and register the domain again with an exclamation point in front (!yourdomain.com), which tells it to generate root-domain records instead. Do that only if you actually need strict alignment; otherwise keep relaxed and keep the subdomain. The other classic failure is the DNS host appending your domain to the hostname (GoDaddy and Squarespace do this), giving gh-mail.yourdomain.com.yourdomain.com; delete the duplicated part and re-check.

Confirm it worked

• Check in Greenhouse. On Email Settings, click Show domain details then Check DNS Records Now. The ellipses in the table turn into check marks when each record resolves. Greenhouse allows up to 48 hours for DNS changes to appear; if a row is still pending, compare its Hostname and Required Value against what you entered.
• Send a test and read the headers. Send a candidate email to yourself, open the message, and confirm the “via greenhouse.io” flag is gone and the result shows dmarc=pass. Our header analyzer reads it back plainly, including which domain the DKIM signature and Return-Path carry.
• Watch the reports. Greenhouse should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. If it shows as failing on both SPF and DKIM, check whether your policy is strict.