SMTP2GO SPF and DKIM setup

What you are setting up

SMTP2GO is an SMTP relay for your application and transactional mail. You verify your sender domain by publishing three CNAME records, and SMTP2GO handles the rest behind them. There is no SPF record or DKIM key to paste, it is entirely CNAME-based, and the three CNAMEs cover SPF (via a return-path), DKIM, and link tracking. Since April 2025, verifying your domain is not optional: SMTP2GO rejects mail sent from an unverified domain.

Add the sender domain and publish the CNAMEs

In SMTP2GO, go to Sending > Verified Senders > Sender domains and click Add sender domain. SMTP2GO generates three CNAME records, all pointing at smtp2go.net hosts:

Type:  CNAME   (return-path / SPF; e.g. return.yourdomain.com -> return.smtp2go.net)
Host:  (copy the exact host SMTP2GO shows you)
Value: (copy the exact target SMTP2GO shows you)

Type:  CNAME   (DKIM)
Host:  (copy the exact host SMTP2GO shows you)
Value: (copy the exact target SMTP2GO shows you)

Type:  CNAME   (open / click / unsubscribe tracking)
Host:  (copy the exact host SMTP2GO shows you)
Value: (copy the exact target SMTP2GO shows you)

Copy all three exactly from the console, they are specific to your account. The first CNAME sets a return-path on a subdomain of yours (so SPF aligns), the second delegates DKIM (so SMTP2GO signs as d=yourdomain.com), and the third serves tracked links over HTTPS on your domain. You can rename the return-path and tracking hosts. Together they align both SPF and DKIM, so DMARC passes. SMTP2GO can also add the records for you automatically through Entri, without storing your DNS login.

Do you need an SPF include? No.

SMTP2GO's own guide says there is no need to update your SPF record, so the old advice to add an include: for SMTP2GO is out of date. The return-path CNAME handles SPF for you; do not add a manual SPF include.

Add DMARC

SMTP2GO does not publish DMARC for you; add your own standard _dmarc TXT. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The SMTP2GO gotcha

The big one now: SMTP2GO refuses mail from a domain you have not verified. Since April 11, 2025, mail whose from domain is not a verified sender is rejected with 550 From header sender domain not verified (it shows as “Rejected” under Reports > Activity), and those rejected attempts still count against your monthly quota. The fix is always to verify the exact domain in your from address; a subdomain can send once its parent domain is verified, as long as the subdomain exists in your DNS. As general DNS advice, also make sure your host has not appended your domain to the CNAME (doubling it), and that the records are not proxied (set them to DNS-only on Cloudflare).

Confirm it worked

• Verify in SMTP2GO. The sender domain should show as verified once the three CNAMEs resolve.
• Send a test and read the headers. Send through SMTP2GO, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass (and no “via smtp2go” notice). Our header analyzer reads it back plainly.
• Watch the reports. SMTP2GO should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.