MailerSend SPF and DKIM setup

What you are setting up

MailerSend is the transactional-email service from the MailerLite team. You authenticate a sending domain by publishing four DNS records: one SPF TXT, two DKIM CNAMEs, and a return-path CNAME. The CNAMEs mean MailerSend holds the actual keys and can rotate them without you touching DNS again. The return-path record is the part most guides skip, and it is the one that makes your SPF align with your domain rather than merely pass.

Publish SPF and DKIM

In MailerSend, go to Email > Domains, click Add domain, and enter your domain. MailerSend offers to connect to your registrar and add the records automatically; close that pop-up if you would rather add them yourself. The manual DNS page then lists the records, each with a click-to-copy value. The shape is:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:_spf.mailersend.net ~all

Type:  CNAME   (DKIM key 1)
Host:  ms1._domainkey
Value: ms1._domainkey.mailersend.net

Type:  CNAME   (DKIM key 2)
Host:  ms2._domainkey
Value: ms2._domainkey.mailersend.net

Type:  CNAME   (Return-Path)
Host:  mta
Value: mailersend.net

If your domain already has an SPF record, MailerSend shows a value that is already merged with it; publish that one and delete the old record, because a zone with two SPF records fails verification (and fails SPF everywhere else too). The DKIM selectors are ms1 and ms2, and the keys behind them are 2048-bit. The return-path host defaults to mta and can be changed with Edit on the Domains page. Once the records are in, tick I have added DNS records and click Finish verification. It usually completes in minutes; MailerSend says to allow up to 48 hours, then hit Re-check now.

Add DMARC

Standard _dmarc TXT record, nothing MailerSend-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. MailerSend bundles a DMARC monitoring tool of its own (30 days free on Starter, included on Professional), but the record it generates is the same _dmarc TXT; you only need one.

The MailerSend gotcha

Two DKIM records, and you need both. MailerSend moved from one 1024-bit key to a pair of 2048-bit keys, so a domain now needs both the ms1 and ms2 CNAMEs. Publish only one and the domain sits at unverified with no clearer error than that. If you verified the domain before the change, MailerSend keeps the old record working for now but still asks you to add the two new ones. The second catch is your DNS host appending the domain to a CNAME host, giving ms1._domainkey.yourdomain.com.yourdomain.com; enter only the host portion, and check the values character by character, because MailerSend compares them case-sensitively.

Do not skip the return-path CNAME. Without it, MailerSend’s bounce address is on a MailerSend domain, and while SPF may pass for that domain, it does not align with yours, so DMARC leans entirely on DKIM. With mta pointed at mailersend.net, bounces go to mta.yourdomain.com, a subdomain of your domain, and SPF aligns under DMARC’s default relaxed mode. Two aligned signals are what you want before you move to p=reject.

Confirm it worked

• Check the Domains page. The domain should show as verified once all four records resolve. If it does not after a while, re-read the troubleshooting list: one SPF record, both DKIM CNAMEs, exact case.
• Send a test and read the headers. Send through MailerSend, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=ms1 or s=ms2, the Return-Path is on mta.yourdomain.com, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. MailerSend should appear as an aligned, passing source on both SPF and DKIM in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.