Setup guides
Each sender guide lists the exact DNS records a service needs for SPF, DKIM and DMARC, checked against its official documentation, with the steps on the service's side. The DNS host guides cover the other half: where to add a TXT or CNAME record in that provider's panel and what to type in the host field.
Once the records are published, enter your domain in the “Check it” box on the sender guide and press Check SPF, Check DKIM or Check DMARC. Each button opens the matching checker with your domain filled in, and the DKIM button also carries that service's selector, so the lookup lands on the right key.
Mailbox providers
- Fastmail7 DNS records (2 MX, 2 TXT, 3 CNAME) · DKIM selectors fm1, fm2, fm3, mesmtp
- Google Workspace3 DNS records (3 TXT) · DKIM selector google
- Microsoft 3654 DNS records (2 TXT, 2 CNAME) · DKIM selectors selector1, selector2
- Proton Mail8 DNS records (3 TXT, 2 MX, 3 CNAME) · DKIM selectors protonmail, protonmail2, protonmail3
- Zoho Mail3 DNS records (3 TXT) · DKIM selectors zmail, zoho
Marketing platforms
- ActiveCampaign3 DNS records (2 CNAME, 1 TXT) · DKIM selector acdkim1
- Brevo4 DNS records (2 TXT, 2 CNAME) · DKIM selectors brevo1, brevo2
- Constant Contact3 DNS records (1 CNAME, 2 TXT)
- HubSpot4 DNS records (2 CNAME, 2 TXT)
- Kit3 DNS records (2 CNAME, 1 TXT) · DKIM selector cka
- Klaviyo5 DNS records (3 CNAME, 2 TXT) · DKIM selectors km1, km2, km3, km4, kt1, kt2, ks1, ks2, kl1, kl2
- Mailchimp3 DNS records (2 CNAME, 1 TXT) · DKIM selectors k2, k3
- Shopify Email2 DNS records (1 CNAME, 1 TXT)
Transactional email
- Amazon SES5 DNS records (3 CNAME, 1 MX, 1 TXT)
- Mailgun5 DNS records (2 TXT, 2 CNAME, 1 MX) · DKIM selectors pic, mx, smtp, k1, krs, pdk1, pdk2
- Mailjet4 DNS records (3 TXT, 1 CNAME) · DKIM selector mailjet
- Postmark2 DNS records (1 TXT, 1 CNAME)
- Resend3 DNS records (1 MX, 2 TXT) · DKIM selector resend
- SendGrid4 DNS records (3 CNAME, 1 TXT) · DKIM selectors s1, s2
- SparkPost2 DNS records (1 TXT, 1 CNAME)
Help desks
DNS hosts
- Amazon Route 53With simple routing, Route 53 keeps every TXT value for a name in one record. Add a new value, such as a verification string next to SPF, on its own row in the existing TXT record instead of creating another record.
- BluehostHosting plans also offer cPanel → Domains → Zone Editor for domains that use Bluehost's nameservers.
- CloudflareSet every CNAME used for DKIM or a return-path to DNS only (grey cloud). Proxied CNAMEs break email authentication.
- DigitalOceanAdding a domain creates NS records for DigitalOcean's name servers automatically.
- GoDaddyGoDaddy sometimes creates a _dmarc record for you. Edit that record instead of adding a second one, or DMARC stops working.
- HostingerDomains registered elsewhere but using Hostinger's nameservers appear under External domains.
- IONOSIONOS shows a warning, rather than deleting anything, when a new record conflicts with the records of an active service.
- NamecheapMX records for mailboxes live under Mail Settings → Custom MX on the same tab.
- PorkbunNameservers are changed in a separate menu from DNS records. Porkbun's own are curitiba, fortaleza, maceio and salvador.ns.porkbun.com.
- Squarespace DomainsSquarespace took over every Google Domains registration on September 7, 2023. If your domain came from Google Domains, its DNS settings are now in your Squarespace account.
- VercelIf your email provider is listed under Add DNS Preset, picking it adds its records for you.
- WixMX records have their own screen: choose Edit MX Records from the Domain Actions menu.
How to use these guides
Pick a guide for every service that sends as you
Start with a list of everything that sends email with your domain in the From line: your mailboxes, your newsletter tool, the app that sends receipts and password resets, your help desk. Each of them needs its own records, so open the guide for each one. If you don't know the full list yet, the DMARC reports you start receiving in the last step will show you the ones you missed.
Sender guides and DNS host guides
The two kinds answer different questions. A sender guide tells you what to publish: the SPF include, the DKIM records and their selectors, the DMARC record, and the steps in that service's own settings. A DNS host guide tells you where: which screen of your registrar or DNS provider holds the records, what to type in the host field, and the provider's quirks, such as proxied CNAMEs or records it creates on its own. Most setups need one guide of each kind open side by side.
Work in this order
- SPF. Add each service's include to your one SPF record. Merge, never add a second record.
- DKIM. Publish each service's key or CNAMEs, then turn signing on in the service. DKIM is what lets DMARC pass for services that send with their own bounce address.
- DMARC. Publish
p=nonewith a report address once SPF and DKIM work; Google suggests waiting 48 hours after setting them up. Tighten the policy only when the reports show every sender passing.
SPF vs DKIM vs DMARC explains why this order works, and the checkers confirm each step before you move to the next.