Sender SPF and DKIM setup

What you are setting up

Sender is the email marketing and transactional platform at sender.net (not to be confused with the generic word). It will not send a campaign from a domain you have not verified, and the verification is two-step: prove you own the domain by clicking a link sent to an address on it, then publish the DNS records so Sender signs as you and your mail aligns. Sender wants all three of SPF, DKIM, and DMARC showing green before you send, which is more than most ESPs ask, and it hands you a DMARC record to copy. Two of the three values it hands you are weaker than they should be, which is the gotcha below.

Publish SPF and DKIM

In Sender, go to Account settings > Domains and click Add domain. Enter your domain and an email address on it, click Verify ownership, and follow the link in the email Sender sends. Back in the DNS records dialog you will see the records to add:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:sendersrv.com ~all

Type:  CNAME   (DKIM)
Host:  sender._domainkey
Value: dkim.sendersrv.com

The DKIM selector is sender and the record is a CNAME, not a TXT: it points at a key that Sender hosts and manages, so there is no long p= string to paste and nothing for you to rotate. If your DNS host offers a TXT field for DKIM, ignore it and add a CNAME. If you already have an SPF record, merge include:sendersrv.com into it rather than adding a second one; Sender's own docs say the same. Then click Check SPF, DKIM and DMARC records. Sender says most records verify within minutes, and there is a Recheck DNS records button if you had to wait.

Add DMARC

Sender shows you a DMARC record alongside the other two, and it expects to see one published before it marks the domain fully verified. Its template is the bare minimum, so publish this instead:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Sender gotcha

The SPF Sender hands you ends in ?all. That is the neutral qualifier: it tells receivers that a server not on the list is neither authorized nor forbidden, which is the same as saying nothing. It passes Sender's own check, but it does not tell anyone to distrust a spoofer. Use ~all as shown above; every host Sender actually sends from is inside include:sendersrv.com, so nothing of yours breaks. Our SPF tester will show you the difference.

The DMARC template has no reporting address. Sender's record is v=DMARC1; p=none; and nothing else. That satisfies the mailbox providers' “have a DMARC record” rule and satisfies Sender's checker, but with no rua= tag you receive no aggregate reports, so you never learn who else is sending as your domain and never get the evidence to move past p=none. Add the reporting address before you tick the box.

The other usual issue is the DNS host appending your domain to the record name (giving sender._domainkey.yourdomain.com.yourdomain.com); enter only the host portion.

Confirm it worked

• Check in Sender. All three columns (SPF, DKIM, DMARC) should show a green tick once the records resolve.
• Send a test and read the headers. Send a campaign test through Sender, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=sender and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Sender should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.