Lever SPF and DKIM setup

What you are setting up

Lever is an applicant tracking system, and it sends candidate email two ways. When a recruiter sends from their own address, Lever routes the message through that user's connected Google Workspace or Office 365 work account. When they pick Lever Mail in the From field, the message goes out from an @hire.lever.co address that Lever owns. Neither path gives you a Lever DNS record to publish. There is no include: for Lever and no lever._domainkey selector; searching Lever's help center for DKIM returns nothing, and that is correct. Your mail authenticates because your mailbox provider authenticates it.

Publish SPF and DKIM

First, make sure Lever is actually sending through your mailboxes. Each user goes to Settings > My account and checks the Email permission, then completes the sign-in flow for Google or Microsoft. A Super Admin can instead choose Settings > Company > General > Limited sync, which grants send-only access; mail is still routed through the user's Google or Office 365 account, replies just do not sync back.

Then publish the records for whichever provider hosts those mailboxes. If you already did this for your day-to-day mail, Lever is covered. For Google Workspace:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:_spf.google.com ~all

Type:  TXT     (DKIM)
Host:  google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFA... (from the Admin console)

For Microsoft 365:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spf.protection.outlook.com -all

Type:  CNAME   (DKIM)
Host:  selector1._domainkey
Value: (the target shown in the Defender portal)

Type:  CNAME   (DKIM)
Host:  selector2._domainkey
Value: (the target shown in the Defender portal)

The step-by-step for each, including the Google “Start authentication” click that people miss and the Microsoft DKIM enable toggle, is in our Google Workspace and Microsoft 365 guides. Keep a single SPF record and merge the include into it.

Add DMARC

Standard _dmarc TXT record, nothing Lever-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Lever gotcha

Lever Mail is not your domain. Mail sent as Lever Mail, and every automation or notification from no-reply@hire.lever.co, carries Lever's domain in the From address (hire.eu.lever.co on the EU data center). It never touches your SPF or DKIM, and it will not appear in your DMARC reports at all, so a clean report does not mean your recruiters are sending as you. Check which From option your team actually uses. The other trap is the provider matrix: Lever's comparison table shows that an account with no Google, Office 365, Exchange, or Zimbra sync (the SPF/ICS option, which sends through Lever's own provider) cannot send from an @company.com address at all. If you want candidate mail to come from your domain, connect a real mailbox. Do not add a Lever or Mailgun include to your SPF record hoping to cover it; Lever does not document one, and it would only spend lookups.

Confirm it worked

• Send a test and read the headers. Send a candidate email from Lever using your own address as the sender, open it at the other end, and confirm the DKIM signature shows d=yourdomain.com with dmarc=pass. Our header analyzer reads it back plainly. If the signing domain is hire.lever.co, the message went out as Lever Mail.
• Check the mailbox provider, not Lever. Lever has no verification screen for DNS. The Google Admin console or the Microsoft Defender portal is where SPF and DKIM status shows.
• Watch the reports. Lever-originated mail will show up as Google or Microsoft in your DMARC aggregate reports, aligned and passing, because that is the server that delivered it. trustyourinbox labels it accordingly.