Typeform SPF and DKIM setup

What you are setting up

Typeform sends email from two very different places. Form submission notifications, and the older Messages feature, go out from notifications@typeform.com or notifications@followups.typeform.io, addresses Typeform owns. Emails built with Automations (the Contacts & Automations add-on, available on the Plus, Business, Talent, Growth Custom, and Enterprise plans and included with Growth Flow) can instead be sent from an address on your own domain, but only after you add and authorize that domain. Until you do, Automation emails also leave from notifications@followups.typeform.io with the sender name Typeform Notifications, and you cannot change either. The records Typeform asks for are Mailgun's: the DKIM CNAMEs point into mgsend.org and the SPF include is mailgun.org, because Mailgun is the service actually putting the mail on the wire. So when Typeform verifies your domain, what you have really done is authorize a slice of Mailgun to sign as you.

Publish SPF and DKIM

In Typeform, open Admin settings under your Organization icon in the top left corner. Under Automation email domains, click Add email domain and enter the domain itself, not an address, then click Add. Typeform offers to add the records for you through Entri, a connect-to-your-registrar tool; if you would rather see and own the records, choose go to our manual setup, pick your DNS provider (or Other), and click Continue. The Create records step then lists them, each with a click-to-copy value. The shape is:

Type:  CNAME   (DKIM key 1)
Host:  pdk1._domainkey
Value: pdk1._domainkey.<account-id>.dkim1.us.mgsend.org   (copy the exact target Typeform shows)

Type:  CNAME   (DKIM key 2)
Host:  pdk2._domainkey
Value: pdk2._domainkey.<account-id>.dkim1.us.mgsend.org

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:mailgun.org ~all

Type:  CNAME   (open and click tracking)
Host:  email
Value: mailgun.org

The two DKIM selectors are pdk1 and pdk2, and because they are CNAMEs, Typeform and Mailgun can rotate the keys behind them without you touching DNS again. The email CNAME is the same open-and-click tracking host Mailgun uses everywhere; it is not an authentication record, but it is on Typeform's list, so publish it. Typeform's article names MX among the record types you might be handed, but the records in its own screenshots are these four; publish whatever your account actually shows. If your domain already has an SPF record, add include:mailgun.org to it rather than creating a second one, because a zone with two SPF records fails SPF everywhere. Then go back to Admin settings and click Check status. Typeform says it can take up to 48 hours to authorize, but in most cases it happens in seconds, and the domain shows a green Authorized tag. Once it does, the Send from field on any Send email action accepts an address on that domain.

Add DMARC

Standard _dmarc TXT record, nothing Typeform-specific. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. If you took Typeform's subdomain route and authorized info.yourdomain.com, the DMARC record on your root domain already covers it under the default relaxed alignment; you do not need a second one.

The Typeform gotcha

The custom domain covers Automations only. Form submission notifications and legacy Messages keep leaving from notifications@typeform.com or notifications@followups.typeform.io no matter what you publish. They never touch your SPF or DKIM, and they will not appear in your DMARC reports at all, so a report that never mentions Typeform does not mean the setup worked; it may mean nobody has moved to Automations yet. The shared address has its own costs too: no sender name, no delivery or open metrics, and a global opt-out, so a respondent who unsubscribes from one Typeform customer stops hearing from all of them. Authorizing a domain is what lifts every one of those limits.

Typeform hands you fully qualified hosts. The first box on each record reads pdk1._domainkey.yourdomain.com, and most DNS providers append your domain to whatever you type, giving you pdk1._domainkey.yourdomain.com.yourdomain.com. Typeform's own troubleshooting section says to delete the .yourdomain.com portion and enter only pdk1._domainkey, and to type @ for the SPF TXT host instead of pasting the domain again. Do that first when Check status refuses to turn green. The other thing to know is that Typeform does not document a bounce or return-path record, so do not count on SPF alignment; DKIM with d=yourdomain.com is the signal that carries alignment here, which is why both CNAMEs matter. Read the Return-Path in a test message's headers before you assume anything about SPF.

Confirm it worked

• Check Admin settings. The domain under Automation email domains should carry the green Authorized tag. If it still does not after the host-field fix, compare each value against the Create records panel character by character.
• Send a test and read the headers. Trigger an Automation that sends to you, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=pdk1 or s=pdk2 and the result is dmarc=pass. Our header analyzer reads it back plainly. If the signing domain is followups.typeform.io, the Send from field is still on the shared address.
• Watch the reports. Typeform Automation mail arrives from Mailgun's infrastructure, so it shows up in your DMARC aggregate reports as Mailgun, aligned and passing on DKIM. trustyourinbox labels it accordingly, and a Mailgun source you did not expect is often exactly this.