SendPulse SPF and DKIM setup

What you are setting up

SendPulse is an all-in-one marketing platform: email campaigns, an SMTP relay, automations, chatbots, and more, all under one account. For email, you activate an authenticated domain by publishing two TXT records that SendPulse generates for you: one SPF record with the mxsspf.sendpulse.com include, and one DKIM public key at the sign selector. Unlike vendors that hand you CNAMEs, SendPulse gives you the key itself, so the value lives in your zone and SendPulse cannot rotate it without you republishing. The good news is that one set of records covers the whole account. SendPulse says outright that if you have set up SPF and DKIM in the email service, you do not need to set them up again for SMTP, because all services share the same record settings.

Publish SPF and DKIM

In SendPulse, go to Email > Settings > Domain settings. In the Authenticated domain section, click Activate, enter your domain, and click Get SPF and DKIM Records. SendPulse shows the name and value for each record, ready to copy. The shape is:

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:mxsspf.sendpulse.com +a +mx ~all

Type:  TXT     (DKIM)
Host:  sign._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ... (from your account)

If your domain already has an SPF record, do not add a second one. SendPulse's own instruction is to add include:mxsspf.sendpulse.com to the record you already have; a zone with two SPF records fails SPF everywhere. The +a +mx pair in SendPulse's template lists your own web and mail hosts as well, which is harmless if they send for you and wasted lookups if they do not, so keep them only if you need them. For the DKIM record, some DNS hosts want sign._domainkey as the host and append your domain themselves; others (cPanel, for one) want the full sign._domainkey.yourdomain.com. Paste the value without quotes, which SendPulse calls out specifically because quoted keys are the most common reason a DKIM check fails.

To confirm, go back to Domain settings, click the three dots next to the domain in the Authenticated domain section, choose Show Settings, and click Check DNS records. Each record gets a green check when it resolves and the status changes from Awaiting confirmation to Connected. SendPulse says to allow up to 24 hours depending on your DNS host; in practice it is usually minutes.

Add DMARC

Standard _dmarc TXT record, nothing SendPulse-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. SendPulse's own DMARC article jumps straight to a p=reject example with forensic reporting turned on. Do not copy that on day one. It does make one point worth keeping: publish SPF and DKIM first, then DMARC, because a policy with nothing aligned behind it only hurts your own mail.

The SendPulse gotcha

The From domain must be the authenticated domain. SendPulse states it plainly: to pass spam filters, the domain in the Authenticated domain setting must match the sender's address domain. Activating yourdomain.com and then sending a campaign from news.yourdomain.com, or from a second brand's domain, gives you a DKIM signature that does not align with the From header, and DMARC ignores an unaligned pass. Activate every domain you send from, each with its own sign._domainkey record. The second catch is that SendPulse issues a TXT key, not a CNAME. If SendPulse ever regenerates the key for your account, the record in your zone goes stale and DKIM starts failing quietly, so re-run Check DNS records whenever a campaign's deliverability dips.

SPF may pass without aligning. SendPulse does not document a custom Return-Path or bounce domain for campaign mail, so the envelope sender is on a SendPulse domain and the SPF result, while it passes, does not align with your From domain. That is normal for a shared marketing platform and DMARC only needs one aligned signal, but it means DKIM is doing all the work for you. Keep that key healthy before you move to p=reject. One more: the number of domains you can authenticate depends on your plan, Email and SMTP share one list, and a subdomain such as mail.yourdomain.com counts as a separate domain.

Confirm it worked

• Check the Domain settings page. Under Show Settings, both records should carry a green check and the domain should read Connected. If one stays on Awaiting confirmation, re-copy the value, drop any quotes, and check that your DNS host did not double up the domain on the host name.
• Send a test and read the headers. Send a campaign test to yourself, open it, and confirm the DKIM signature shows d=yourdomain.com with s=sign, and the result is dmarc=pass. Our header analyzer reads it back plainly. Expect the Return-Path to be on a SendPulse domain; that is the SPF-alignment point above, not a fault.
• Watch the reports. SendPulse should appear in your DMARC aggregate reports as a passing source, aligned on DKIM, labeled as a known sender in trustyourinbox. If it shows DKIM failing, the key in your zone no longer matches the one in your account.