Iterable SPF and DKIM setup

What you are setting up

Iterable is a marketing automation platform, not a mail server. By default it sends your email through Iterable’s own Amazon SES account on a shared IP pool, and you can instead connect your own SparkPost, Mailgun, or SendGrid account (SendGrid is US data center only). Which path you are on decides where your DNS records come from. On the default Amazon SES setup, Iterable generates the records for you and shows them on one page in the app. On your own ESP, the records come from that ESP, and Iterable’s DNS page does not apply.

Publish SPF and DKIM

On the default setup, Iterable sends from the domain associated with your organization’s website unless you tell it otherwise. To send from a different domain, go to Settings > Project Settings, turn on Custom sending domain for shared IPs, enter the domain, and click Save. Then open Settings > DNS Setup. Every record on that page is specific to the domain you just set, so add each one exactly as shown:

Settings > DNS Setup lists, for your sending domain:
  - the SPF record (TXT)
  - the DKIM record(s)
  - the tracking-domain alias, e.g. links.yourdomain.com
    pointing at links.iterable.com (US) or links.eu.iterable.com (EU)

The DKIM key is unique to your account, so copy it from the console rather than from any guide. If you already have an SPF record, merge the include Iterable gives you into it rather than publishing a second one; two SPF records is a permanent fail. Iterable recommends a subdomain that is clearly related to your website, such as mail.yourdomain.com for www.yourdomain.com, and separate subdomains per mail stream (for example deals. for promotions and info. for transactional). Once the records resolve, add your From addresses under Settings > Senders; a sender on a verified domain is marked verified automatically.

If you use your own ESP instead, do not touch the Project Settings toggle. Add the domain under Settings > Domains > New sending domain, pick the ESP account that is already authorized for it, and click Verify Domain. The SPF and DKIM records themselves come from your ESP, so follow our SparkPost, Mailgun, or SendGrid guide for those.

Add DMARC

Standard _dmarc TXT record, nothing Iterable-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Iterable’s own guidance is the same: publish DMARC, but only enforce once you understand every stream sending on your behalf.

The Iterable gotcha

One sending domain, and the toggle resets everything. On the default Amazon SES setup a project gets exactly one sending domain; if you need a second domain or subdomain you must bring your own ESP. And the domain field is not a free edit: changing Custom sending domain for shared IPs regenerates the records on the DNS Setup page and resets your existing domain and sender verifications, so every sender goes back to unverified until the new records are published. Decide the domain once, before you publish anything. The second trap is the two settings pages: the Project Settings field is for the default SES path only, and the Domains page is for your own ESP only. Enter the domain in the wrong one and Iterable either ignores it or shows DNS records that do not match how your mail actually leaves.

Confirm it worked

• Check the sender. Under Settings > Senders, your From address should show as verified once the DNS Setup records resolve. If Amazon emails you a verification link instead, the domain records are not live yet.
• Send a proof and read the headers. Send a test campaign to yourself and confirm the DKIM signature shows d=yourdomain.com and the result line shows dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Iterable should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. A DKIM-pass, SPF-unaligned row is normal on shared-pool sending; DKIM alignment alone carries DMARC.