Setup guide

Mailjet: SPF, DKIM and DMARC

Mailjet needs an SPF include and a DKIM TXT key at mailjet._domainkey. SPF alignment for DMARC needs a custom return path, which support activates on paid accounts.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Mailjet documentation on October 13, 2026

DNS records to add

TXTHost@

v=spf1 include:spf.mailjet.com ~all

SPF: authorizes Mailjet's servers

TXTHostmailjet._domainkey

<DKIM key from Mailjet → SPF/DKIM Authentication, like k=rsa; p=…>

DKIM signing key

CNAMEHostbnc3

bnc3.mailjet.com

Custom return path for SPF alignment (optional, paid accounts, activated by support)

TXTHost_dmarc

v=DMARC1; p=none; rua=mailto:<your report address>

Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.

DMARC policy, starting at p=none as Mailjet recommends

Steps

In Mailjet open Account Settings → Senders & Domains, click Add a domain or sender address, choose Add domain and publish the TXT record it shows to validate the domain.
Click the gear icon next to the domain and choose Setup SPF/DKIM Authentication.
Publish the SPF TXT record and the DKIM TXT record with the key Mailjet shows.
Wait for both SPF and DKIM to show OK in green in Mailjet.

Common mistakes

Until SPF and DKIM are set up for the domain, recipients can see "via bnc3.mailjet.com" next to your sender name.
Some DNS hosts reject or truncate 2048-bit and 4096-bit DKIM keys. If yours does, regenerate a 1024-bit key in Mailjet and replace the DNS record.
Mailjet's Regenerate Key button stays greyed out while only a sender address is validated. Validate the entire domain first.
Some providers add your domain to the end of the Host field when they save it. Check the saved name reads mailjet._domainkey.yourdomain.com and isn't doubled.

Good to know

By default the Return-Path is bnc3.mailjet.com. For a custom return path, publish the bnc3 CNAME, validate the domain and open a support ticket with your API key and the record; each API key can have one.
Mailjet suggests relaxed SPF alignment with a custom return path, because bnc3.yourdomain.com never exactly matches a From address on yourdomain.com.

Frequently asked questions

How long does Mailjet take to see my SPF and DKIM records?

DNS changes can take anywhere from a few minutes to 48 hours to propagate.

Does Mailjet replace the DKIM key of a domain I authenticated earlier?

Not automatically. New keys are 2048-bit by default, but domains authenticated before that keep their key until you regenerate it under SPF/DKIM Authentication.

Why does Mailjet recommend a sender address on my own domain over webmail?

You can't change SPF or DKIM for free webmail domains such as gmail.com or yahoo.com, so Mailjet can't authenticate them for you.

Which DMARC policy does Mailjet suggest starting with?

p=none. Move to p=quarantine or p=reject only once you're confident your traffic authenticates.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Mailjet documentation.

Check your Mailjet setup

Or open the SPF checker, DKIM checker or DMARC checker directly.