Squarespace SPF and DKIM setup

What you are setting up

Squarespace Email Campaigns sends your newsletters and marketing mail from an address at your domain. To authenticate it you publish one DKIM CNAME, so Squarespace signs as your domain, plus a _dmarc TXT record Squarespace generates for you. There is no SPF record to add: Squarespace dropped that requirement, and DKIM alone is what carries your campaigns through DMARC. Verifying the domain covers every sender address on it, so do it once at the domain level. If you bought the domain from Squarespace, or it migrated there from Google Domains, it is verified automatically and there is nothing to publish.

Publish SPF and DKIM

In Squarespace, open the Email Campaigns settings panel, add your sender details, then under Sender details click Authenticate. Squarespace shows two records for your domain:

Type:  CNAME   (DKIM)
Host:  squarespace._domainkey
Value: squarespace-domainkey.squarespace-mail.com

Type:  TXT     (DMARC)
Host:  _dmarc
Value: (the value Squarespace shows you)

The DKIM selector is squarespace, and because it is a CNAME rather than a pasted key, Squarespace can rotate the key on its side without you touching DNS. Add both records at whoever hosts your DNS. If the domain is connected to Squarespace by nameservers, that is the Squarespace domains panel (Domains managed by third-party > Edit > DNS settings > Custom records); if it is connected by DNS records, it is your registrar or DNS provider. Enter only the host portion, or you will end up with squarespace._domainkey.yourdomain.com.yourdomain.com. Records can take up to 48 hours to resolve.

Add DMARC

Squarespace hands you a _dmarc value as part of verification, and a domain can only carry one DMARC record. If you do not have one yet, publish the value Squarespace shows. If you already have one, keep yours and check it starts at least in monitor-only mode with a reporting address:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean.

The Squarespace gotcha

p=reject locks you out until DKIM resolves. If your domain is already at p=reject, Squarespace will not let you use the sender details until the domain verifies, because unsigned campaigns would be rejected outright. Publish the CNAME first, wait for it to resolve, then send. The other surprise is the SPF one: older guides (and older Squarespace instructions) told you to add an include for Squarespace to your SPF record. That is gone. Do not go looking for one, and do not spend one of your ten SPF lookups on a stale value; the return path stays on Squarespace's side and DKIM alignment does the work. Finally, if Squarespace manages the domain and it still shows as unauthenticated, Squarespace's own fix is to delete and recreate the sender details, which re-runs the automatic setup.

Confirm it worked

• Check the sender details. Once the records resolve, the “Domain is unauthenticated” note under your domain in Sender details disappears.
• Send a test and read the headers. Send a campaign to yourself, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=squarespace and dmarc=pass. Our header analyzer reads it back plainly. An SPF result that is not aligned to your domain is expected here and does not matter.
• Watch the reports. Squarespace should appear as a DKIM-aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.