SparkPost SPF and DKIM setup

What you are setting up

SparkPost (now part of Bird) sends your transactional mail. Like other transactional platforms, DKIM is what carries DMARC: you publish one DKIM record and SparkPost signs with your domain, which aligns out of the box. SPF is optional, it only aligns if you also set a custom bounce domain, so think of DKIM as the required step and the SPF pieces as a belt-and-suspenders add-on.

Set up DKIM

In SparkPost, go to Configuration > Domains and create a sending domain. SparkPost generates a DKIM key and shows you a TXT record to publish:

Type:  TXT
Host:  scph0623._domainkey       (the scph selector SparkPost shows you)
Value: v=DKIM1; k=rsa; h=sha256; p=MIGf... (the key SparkPost shows you)

The selector is scph followed by a four-digit date stamp (so it looks like scph0623), and both the selector and the key are generated for your account, so copy the exact values from the dashboard, do not reuse one from an example. Once the record resolves, verify the domain. DKIM signs with d=yourdomain.com, so this alone is enough for SparkPost mail to pass DMARC.

Optional: align SPF with a bounce domain

By default, SparkPost's return-path is a sparkpostmail.com address, so SPF authenticates but does not align to your domain. If you want SPF alignment too, publish the SPF record and a custom bounce-domain CNAME (the target is shown in your dashboard):

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:_spf.sparkpostmail.com ~all
       (EU accounts: include:_spf.eu.sparkpostmail.com)

Type:  CNAME   (custom bounce / return-path)
Host:  bounce.yourdomain.com
Value: (the hostname SparkPost shows you in the dashboard)

Note the SPF host is _spf.sparkpostmail.com (with the _spf. prefix), a detail that is easy to get wrong. The bounce domain only takes effect once you reference it in your sends (the API return_path or SMTP MAIL FROM), it is not applied automatically.

Add DMARC

Standard _dmarc TXT record. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The SparkPost gotcha

The classic SparkPost failure is the DNS host appending your domain to the DKIM host, turning scph0623._domainkey into scph0623._domainkey.yourdomain.com.yourdomain.comso the key never verifies. Enter only the selector portion. The second is an alignment trap: people verify DKIM, see “verified,” and assume DMARC is fully covered, but without the custom bounce domain their SPF still authenticates on sparkpostmail.com and does not align. That is fine, DKIM carries DMARC, just do not be surprised by an SPF-unaligned line in your reports.

Confirm it worked

• Check the DKIM record. Our DKIM checker confirms the scph record resolves and a key is published.
• Send a test and read the headers. Send through SparkPost, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. SparkPost should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.