Moosend SPF and DKIM setup

What you are setting up

Moosend is an email marketing platform, and it authenticates per sender: the address your recipients see in the From field. Its documentation is blunt that you must publish the two TXT records for SPF and DKIM in your domain's DNS zone before you create a campaign. SPF is one include, spfa.mailendo.com (mailendo.com is Moosend's sending infrastructure), and DKIM is a single TXT record under the ms selector whose value you paste from your account. Because it is a TXT record rather than a CNAME, Moosend cannot rotate the key without you touching DNS again. A DMARC record rounds out the set, and as you will see, Moosend treats it as part of verification rather than an optional extra.

Publish SPF and DKIM

In Moosend, click More > Settings on the menu bar, then Senders on the left, then Add new. Enter the sender name and email address and save. Moosend emails that address an activation link, and the sender stays unverified until someone clicks it. Prefixes such as admin, postmaster, and no-reply are refused, as are free webmail addresses (Gmail, Outlook, Yahoo), a domain with no website behind it, or a domain whose reputation falls under Moosend's threshold. On the Senders page, open Set up DNS; the SPF and DKIM tabs show the values to copy. The shape is:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:spfa.mailendo.com ~all

Type:  TXT     (DKIM)
Host:  ms._domainkey
Value: k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNAD... (from the DKIM tab in Moosend)

If your domain already has an SPF record, edit it rather than adding a second one; Moosend warns that two SPF records make SPF invalid. A merged record for a Google Workspace domain looks like v=spf1 include:_spf.google.com include:spfa.mailendo.com ~all. For the DKIM host, enter only ms._domainkey; GoDaddy and most other hosts append your domain for you, and a sender on a subdomain uses ms._domainkey.subdomain. Moosend says new records usually take effect within 30 minutes, and to allow up to 48 hours before the next step. Then click Verify DNS records. A green checkmark on the sender, and ticked SPF and DKIM boxes on the Senders page, mean it passed.

Add DMARC

Moosend's DNS walkthroughs show a _dmarc record at p=quarantine; pct=100 with both rua and ruf addresses, but the tip under it is the one to follow: if your domain has no DMARC record yet, start at v=DMARC1; p=none. Quarantine on day one punishes every sender you have not authenticated yet, and Moosend only needs the record to exist and be valid.

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. You can skip the ruf tag; most receivers do not send forensic reports, and the aggregate reports are what tell you when quarantine is safe.

The Moosend gotcha

Moosend verifies all three records at once. Its documentation states that verification “takes place for both DKIM, SPF, and DMARC at once, so if one record cannot be verified, verification fails.” People publish the SPF and DKIM records the setup screen asks for, click Verify, and get an error because the domain has no DMARC record. The DMARC record is not optional here. Three more rules from the same page are worth knowing: a subdomain that fails is checked at its parent domain and passes if the parent does; a verified status is held for 48 hours and then re-checked; and the re-check also runs whenever you pick a sender in the campaign wizard, so a DNS change made outside Moosend (a deleted record, a hosting migration) un-verifies every sender on that domain the next time anyone builds a campaign.

Do not assume SPF aligns. Moosend does not document a custom return-path or bounce domain, so the envelope sender on a Moosend campaign is not guaranteed to be on your domain. SPF can pass for Moosend's domain without aligning to yours, which leaves the DKIM signature (d=yourdomain.com, s=ms) as the signal DMARC relies on. That is fine, as long as the DKIM record is actually right. Check the key you paste, too: the example key in Moosend's own documentation starts MIGf, which is the fingerprint of a 1024-bit RSA key. A 2048-bit key starts MIIB. If yours is the shorter kind, note it; Gmail and Yahoo still accept 1024 bits today, but it is the weakest key any of your senders should be using.

Confirm it worked

• Check the Senders page. The sender should show a tick under Verified (the activation email was clicked) and a green checkmark from Verify DNS records, with the SPF/DKIM and DMARC column reporting a valid signature.
• Send a test and read the headers. Send a campaign through Moosend, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=ms, and the result is dmarc=pass. Note the Return-Path domain while you are there. Our header analyzer reads it back plainly.
• Watch the reports. Moosend should appear as a passing, DKIM-aligned source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox. If the row shows SPF passing without alignment, that is the return-path point above, not a misconfiguration on your side.