Yandex 360 SPF and DKIM setup

What you are setting up

Yandex 360 for Business (formerly Yandex Mail for Domain) hosts your mailboxes, so this is a mailbox-provider setup like Google Workspace or Microsoft 365, not a bulk-sending ESP. Three records make it work: an MX so mail arrives, an SPF record so Yandex's outbound servers are authorized, and a DKIM key at mail._domainkey so Yandex signs as your domain. If you delegated the whole domain to Yandex's name servers, Yandex publishes all three for you; this guide is for the usual case where your DNS lives somewhere else.

Publish SPF and DKIM

Start at your DNS host. Delete any existing MX records, then add Yandex's MX and SPF:

Type:     MX
Host:     @
Value:    mx.yandex.net.   (keep the trailing dot if your panel does not add it)
Priority: 10

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 redirect=_spf.yandex.net

That redirect= form is what Yandex documents for a domain that sends only through Yandex. If anything else sends as your domain, use the include form instead (see the gotcha below). Yandex suggests a TTL of 21600 wherever your panel requires one.

For DKIM, sign in to the Yandex 360 admin panel, open Domains, and click Add DKIM next to your domain. Copy the public key from the Configure DKIM signature section and publish it:

Type:  TXT     (DKIM)
Host:  mail._domainkey
Value: v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSq... (the key Yandex shows you)

The selector is mail, fixed for every Yandex domain, and the key is unique to yours, so copy the exact value. Some DNS panels want the full host, mail._domainkey.yourdomain.com; others append your domain themselves, so enter only the host portion there. Yandex says the records can take up to 72 hours to propagate. To refresh the status, go back to Domains, click Verify your domain, then Check.

Add DMARC

Yandex's admin docs stop at DKIM and do not cover DMARC, so this is the standard _dmarc TXT record. Start in monitor-only mode and ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Yandex signs with d=yourdomain.com and sends from your domain, so both SPF and DKIM align without any extra work.

The Yandex 360 gotcha

The default SPF record is a redirect, not an include. v=spf1 redirect=_spf.yandex.net hands your whole SPF evaluation to Yandex's record and ignores everything else you might add to it. The day you bolt on a newsletter tool, a helpdesk, or your own server, you cannot simply append another include:; the redirect= must go. Yandex documents the mixed form for exactly this case:

v=spf1 ip4:203.0.113.10 include:_spf.yandex.net ~all

Note the ~all at the end, which the redirect form does not carry because Yandex's own record supplies it. Keep a single SPF record either way, and check the result with our SPF tester so a second sender does not push you past the 10-lookup limit. The other thing worth knowing: the DKIM record carries t=s, which tells receivers the key is for yourdomain.com only and not for its subdomains. Mail from a subdomain hosted on Yandex needs its own domain entry and its own mail._domainkey record.

Confirm it worked

• Check in Yandex. On the Domains page, Verify your domain then Check should report the MX, SPF, and DKIM records as found once DNS has propagated.
• Send a test and read the headers. Send from a Yandex mailbox on your domain, open the message, and confirm the DKIM signature shows d=yourdomain.com with s=mail and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Yandex should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.