Loops SPF and DKIM setup

What you are setting up

Loops sends your product email, from marketing campaigns and workflows to transactional messages. You give it one sending domain and publish the records it generates: SPF, DKIM, and an MX record. Loops recommends a subdomain such as mail.yourcompany.com rather than your root domain, and the subdomain does not need to exist first; you do not create an A or CNAME for it, the records Loops gives you are all it needs. Loops signs every send with DKIM from your first email, and you never generate or rotate the key yourself.

Publish SPF and DKIM

In Loops, go to Settings > Domain and click View records. Each record has a clipboard icon; copy them into your DNS host one at a time, using the record Type (TXT, CNAME, or MX) rather than its label. The records are unique to your account, so the values below are the shape, not the text to paste:

Type:  TXT     (SPF)
Host:  envelope.mail.yourcompany.com
Value: v=spf1 ... (the record Loops shows you)

Type:  MX
Host:  envelope.mail.yourcompany.com
Value: 10 feedback-smtp.us-east-1.amazonses.com  (the priority and target Loops shows you)

Type:  TXT or CNAME     (DKIM)
Host:  <selector>._domainkey.mail.yourcompany.com
Value: (the record Loops shows you)

Two things stand out. First, Loops puts its SPF record at envelope.yourdomain, the bounce address it sends from, so it never collides with an SPF record you already have at the root; do not merge anything into your existing SPF, and do not move the record up a level. Second, that same envelope host needs the MX record, which is what makes the bounce domain yours and lets SPF align to your domain. Enter the priority exactly as Loops shows it (most hosts want 10 hostname in one field; a few split priority onto its own line). On Cloudflare, set any CNAME to DNS only, not proxied. Then click Verify Records; propagation can take up to an hour, and it is normal for one record to validate before the others.

Add DMARC

Loops includes a default DMARC record on the same page, but you only need one, and it belongs at your root domain (a _dmarc record at yourcompany.com covers mail.yourcompany.com automatically). Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Loops' own guidance is the same ramp we recommend: p=none for a few weeks, p=quarantine once reports show every legitimate sender passing, then p=reject. If Loops is your only sender you can move faster. Build the record with our DMARC builder and progress past p=none when reports are clean.

The Loops gotcha

The MX record is not optional, and the priority is the part people drop. Most senders let you skip MX; Loops does not, because the envelope subdomain has to accept bounces for SPF to align. A missing MX, or one saved without its priority, shows up as a record that never verifies. The second trap is alignment: if your From address is you@yourcompany.com but Loops signs at mail.yourcompany.com, strict alignment fails. Loops' default DMARC record uses relaxed alignment (aspf=r; adkim=r), which is also DMARC's default, so do not add adkim=s to a root record that covers a Loops subdomain. And if your DNS sits at Wix or Dreamhost, check Loops' registrar notes first: Wix will not take MX on a subdomain when it holds your nameservers, and Dreamhost cannot add custom MX at all.

Confirm it worked

• Verify in Loops. Settings > Domain should show Records present in green beside each record.
• Send a test and read the headers. Send yourself an email through Loops and check Authentication-Results for dkim=pass, spf=pass, and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Loops should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.