Netcore Email API SPF and DKIM setup

What you are setting up

Netcore Email API (formerly Pepipost) sends your transactional and API-driven email. To activate a sending domain you publish the records Netcore lists for it: an SPF include, a DKIM record at a _domainkey hostname, and a CNAME for the custom envelope (the bounce address, which is what SPF is checked against). Once DNS verifies, a Netcore delivery team reviews the domain before it goes active. Every one of these values is shown per account in your dashboard, and that copy is the one that counts.

Publish SPF and DKIM

In Netcore Email API, go to Settings > General Settings > Sending Domains and add your domain. You can add the primary domain (mycompany.com) or a subdomain (email.mycompany.com). Netcore then lists the records to create:

Type:  TXT     (SPF, merged into your existing record)
Host:  @
Value: v=spf1 include:_spf.netcorecloud.com ~all

Type:  TXT or CNAME   (DKIM, copy the exact host and value shown)
Host:  the _domainkey hostname Netcore shows you
Value: the value Netcore shows you

Type:  CNAME   (custom envelope / return path)
Host:  the subdomain Netcore shows you, for example delivery
Value: the target Netcore shows you

Netcore's own guide uses include:_spf.netcorecloud.com, while its per-registrar guides show an account-specific include such as include:6033423b.ppspf.net and a DKIM TXT at pepipost._domainkey. Newer accounts get a DKIM CNAME instead, at nc2048._domainkey pointing to a dkim2048.*.netcorecloud.net host, and a custom envelope CNAME pointing to an eapi.*.netcorecloud.net host, where the middle label is your account's region. Do not guess which you have: copy the hostnames and values from the Sending Domains page. If you already have an SPF record, append the include to it rather than adding a second record. Then click Check DNS Records. Netcore says verification usually completes in minutes but can take up to 24 hours to propagate.

Add DMARC

Standard _dmarc TXT record, nothing Netcore-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Netcore gotcha

Verified is not approved. After your records pass the DNS check, the domain enters an approval phase where Netcore's delivery team reviews your website, business, list-building, and mail relevance. Netcore quotes under 2 hours, up to 24 at peak. A domain stuck on “Not Verified” means SPF or DKIM is wrong; a domain that is verified but still not sending is waiting on that review, and DNS changes will not move it. The second trap is the custom envelope CNAME: it is the record that puts your domain in the bounce address, so without it Netcore's SPF passes on Netcore's domain and does not align with yours. DKIM still aligns, so DMARC passes, but you lose the SPF half. On Cloudflare, set that CNAME to DNS only (gray cloud), or the proxy breaks it. Finally, do not build the records from any guide, including this one: the include hostname, selector, and CNAME targets differ by account age and region.

Confirm it worked

• Check DNS Records in Netcore. Each record should show as valid on the Sending Domains page, and the domain should move from verified to active once approval completes.
• Send a test and read the headers. Send through Netcore, open the message, and confirm the DKIM signature shows d=yourdomain.com, the Return-Path is on your custom envelope subdomain, and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Netcore should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.