Setup guide
SparkPost: SPF, DKIM and DMARC
SparkPost signs with a DKIM TXT key it generates for your sending domain. A CNAME bounce domain moves the Return-Path off sparkpostmail.com so SPF aligns too.
By Ahmet Karaca · Updated · Checked against SparkPost documentation on
DNS records to add
<selector>._domainkey<DKIM value from SparkPost, like v=DKIM1; k=rsa; h=sha256; p=…>Get this value from your provider's dashboard.DKIM signing key; also proves you own the sending domain
<bounce subdomain>sparkpostmail.comCustom bounce (Return-Path) domain; use eu.sparkpostmail.com for SparkPost EU
Steps
- Start from SparkPost's Domains create page and add your domain, selecting Bounce Domain as well if it will carry the Return-Path.
- Publish the DKIM TXT record from the DNS Verification section, plus the CNAME from the Bounce section for a bounce domain.
- Verify the domain. After ownership is verified, it stays Pending for up to an hour during compliance review before it shows Verified.
- To use the bounce domain for every message, set it as Default.
Common mistakes
- Using your root domain as a bounce domain sends all of its mail to SparkPost, so you can't receive mail there, and the root CNAME blocks subdomains. SparkPost advises against it.
- Removing a domain from your account and adding it back resets its DKIM TXT value. Update the DNS record before you verify again.
- A verified bounce domain isn't used until you set it as default or name it in the transmission's return_path or the SMTP MAIL FROM.
- A domain shows Blocked if its organizational domain already belongs to another SparkPost account, or if it lacks an A or MX record or a live website with a privacy policy.
Good to know
- SparkPost recommends a subdomain such as mail.example.com as both sending and bounce domain, with both the TXT and CNAME records.
- SparkPost generates selectors like scph0316, so copy the exact host name from the dashboard.
- SparkPost is now part of Bird: sparkpost.com redirects to bird.com, and Bird offers a guide for migrating from SparkPost. These records apply to existing SparkPost accounts.
Frequently asked questions
Why won't SparkPost verify my DKIM record yet?
The record's TTL can keep the change from being visible to SparkPost straight away. Wait a little, then refresh the Sending Domains page.
How long do I have to verify a SparkPost domain?
Two weeks. A sending domain that isn't verified by then is removed from the account.
Can I verify a SparkPost domain without DNS access?
Sending domains can be verified by clicking a link SparkPost emails to an address on the domain. Bounce domains must be verified by CNAME.
Which domain does SparkPost check SPF on?
The bounce domain. If a tool reports a Sender ID failure on your From domain, SparkPost suggests v=spf1 include:_spf.sparkpostmail.com (_spf.eu.sparkpostmail.com for EU).
What size DKIM key does SparkPost generate?
2048 bits by default. Request 1024 only if your DNS host can't store multi-string TXT records.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: SparkPost documentation.
Check your SparkPost setup
Or open the SPF checker, DKIM checker or DMARC checker directly.