SparkPost SPF and DKIM setup

What you are setting up

SparkPost (now part of Bird) sends your transactional mail. Like other transactional platforms, DKIM is what carries DMARC: you publish one DKIM record and SparkPost signs with your domain, which aligns out of the box. SPF is handled by a return-path CNAME on a subdomain of yours, so there is no SPF record to add on your domain apex. Bird's send gate wants DKIM, the return-path CNAME, and a DMARC policy in place before a domain is ready to send.

Set up DKIM

In SparkPost, go to Email > Domains and create a sending domain. SparkPost generates a DKIM key and shows you a TXT record to publish:

Type:  TXT
Host:  <selector>._domainkey       (the selector SparkPost shows you)
Value: v=DKIM1; k=rsa; p=MIGf...    (the key SparkPost shows you)

The selector is assigned to your organization and the key is generated for your account, so copy the exact values from the dashboard; do not reuse one from an example. Once the record resolves, verify the domain. DKIM signs with d=yourdomain.com, so this alone is enough for SparkPost mail to pass DMARC.

Align SPF with the return-path CNAME

SparkPost routes bounces through a return-path host on your domain (its default label is send, as in send.yourdomain.com; you can choose another when you create the domain). The dashboard shows a CNAME for it:

Type:  CNAME   (return-path, covers SPF)
Host:  send                 (or the label you chose)
Value: (the hostname SparkPost shows you in the dashboard)

Receivers follow the CNAME to SparkPost's own SPF record, so the lookup passes and, because the host is a subdomain of yours, it aligns under relaxed alignment. Bird's docs are explicit that no SPF record is needed on your domain apex for this; an include: there would only spend one of your ten lookups.

Add DMARC

Standard _dmarc TXT record. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The SparkPost gotcha

The classic SparkPost failure is the DNS host appending your domain to the DKIM host, turning <selector>._domainkey into <selector>._domainkey.yourdomain.com.yourdomain.com so the key never verifies. Enter only the selector portion. The second is an alignment trap: people verify DKIM, see “verified,” and assume DMARC is fully covered, but if the return-path CNAME is missing, SPF authenticates on SparkPost's own domain and does not align. That is fine, DKIM carries DMARC, just do not be surprised by an SPF-unaligned line in your reports until the CNAME is in.

Confirm it worked

• Check the DKIM record. Our DKIM checker confirms the record at your selector resolves and a key is published.
• Send a test and read the headers. Send through SparkPost, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. SparkPost should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.