Mailjet SPF and DKIM setup

What you are setting up

Mailjet (now part of Sinch) sends your transactional and marketing email. You authenticate your sending domain by publishing two TXT records, an SPF record and a DKIM key, so Mailjet signs as you and your mail aligns. The one thing Mailjet users get wrong is validating a single sender address instead of the whole domain; only the domain-level validation gives you full SPF and DKIM.

Publish SPF and DKIM

In Mailjet, open Account settings, go to the sender domains and addresses page, and open the SPF/DKIM authentication section for your domain. Mailjet shows you two TXT records:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spf.mailjet.com ~all

Type:  TXT     (DKIM)
Host:  mailjet._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq... (the key Mailjet shows you)

The DKIM selector is mailjet, and the key is unique to your account, so copy the exact value from the console. Mailjet supports 2048-bit keys; check that your DNS host accepts a value that long, and regenerate the key in Mailjet if you want to change the size. If you already have an SPF record, merge include:spf.mailjet.com into it rather than adding a second SPF record. Then validate the domain in Mailjet; it also re-checks the records on its own from time to time.

Add DMARC

Standard _dmarc TXT record, nothing Mailjet-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Mailjet gotcha

Validate the domain, not just an address. Mailjet lets you validate a single sender email address, but that does not set up SPF and DKIM for the domain. Authenticate the whole domain so every address on it is covered and new senders on it verify automatically; Mailjet ties the validation to the API key it was done under, so a subaccount needs its own. The other usual issue is the DNS host appending your domain to the record name (giving mailjet._domainkey.yourdomain.com.yourdomain.com or _dmarc.yourdomain.com.yourdomain.com); enter only the host portion, and keep a single SPF record.

Confirm it worked

• Validate in Mailjet. The domain should show SPF and DKIM validated once the records resolve.
• Send a test and read the headers. Send through Mailjet, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Mailjet should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.