Third-Party Sender Setup

Services that send email as your domain, such as your mailbox provider, newsletter tool or CRM, need their own SPF and DKIM setup to pass DMARC. This page lists what common providers need. Other pages link here rather than repeating it.

How Services Pass DMARC

A message passes DMARC when SPF or DKIM passes and aligns with the domain in the From header:

• SPF aligns when the envelope sender (bounce) domain is your domain or a subdomain of it.
• DKIM aligns when the signature's d= domain is your domain or a subdomain of it.

Many services send with their own bounce domain, so SPF passes for them but doesn't align for you. Aligned DKIM is the dependable option: set it up for every service. It also survives forwarding, which SPF doesn't.

Quick Reference

Providers change their setup from time to time. Always copy the exact records from the provider's dashboard; this table shows what to expect.

Provider	SPF	DKIM
Google Workspace	include:_spf.google.com	TXT record at google._domainkey
Microsoft 365	include:spf.protection.outlook.com	CNAME records at selector1._domainkey and selector2._domainkey
Amazon SES	Not needed at your root domain; use a custom MAIL FROM domain	Three CNAME records (Easy DKIM) pointing to dkim.amazonses.com
SendGrid	Covered by the em CNAME record SendGrid gives you	CNAME records at s1._domainkey and s2._domainkey
Mailchimp	Not needed	CNAME records at k2._domainkey and k3._domainkey (older setups use k1)
Postmark	Not needed with a custom Return-Path	TXT record at a date-based selector ending in pm, such as 20230601123456pm._domainkey
Salesforce	include:_spf.salesforce.com	Keys created under Setup → DKIM Keys
Zendesk	include:mail.zendesk.com	CNAME records at zendesk1._domainkey and zendesk2._domainkey

For services not listed here, look for "domain authentication", "sender authentication" or "DKIM" in the service's settings.

Google Workspace

SPF: add include:_spf.google.com to your SPF record:

v=spf1 include:_spf.google.com ~all

DKIM:

1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click Generate new record (use a 2048-bit key).
3. Publish the TXT record it shows at google._domainkey.yourdomain.com.
4. Back in the Admin console, click Start authentication.

Microsoft 365

SPF: add include:spf.protection.outlook.com to your SPF record:

v=spf1 include:spf.protection.outlook.com ~all

DKIM: publish the CNAME records first, then turn on signing. Microsoft won't enable DKIM until the records resolve.

1. In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings, and open the DKIM tab.
2. Select your domain and copy the two CNAME record values shown for selector1._domainkey and selector2._domainkey. They're specific to your tenant.
3. Publish both CNAME records at your DNS provider and wait for them to propagate.
4. Turn on Sign messages for this domain with DKIM signatures.

Amazon SES

DKIM (Easy DKIM): in the SES console, open your domain identity and turn on Easy DKIM. Publish the three CNAME records SES shows:

abc123._domainkey.yourdomain.com  CNAME  abc123.dkim.amazonses.com
def456._domainkey.yourdomain.com  CNAME  def456.dkim.amazonses.com
ghi789._domainkey.yourdomain.com  CNAME  ghi789.dkim.amazonses.com

Verification can take up to 72 hours.

SPF: by default, SES sends with its own bounce domain, so adding include:amazonses.com to your root SPF record doesn't help DMARC. For SPF alignment, set a custom MAIL FROM domain (a subdomain such as mail.yourdomain.com) and publish the records SES gives you, for example:

mail.yourdomain.com  MX   10 feedback-smtp.us-east-1.amazonses.com
mail.yourdomain.com  TXT  "v=spf1 include:amazonses.com ~all"

SendGrid

In SendGrid, go to Settings → Sender Authentication and click Authenticate Your Domain. With automated security (the default), SendGrid gives you three CNAME records:

em1234.yourdomain.com          CNAME  u1234567.wl123.sendgrid.net
s1._domainkey.yourdomain.com   CNAME  s1.domainkey.u1234567.wl123.sendgrid.net
s2._domainkey.yourdomain.com   CNAME  s2.domainkey.u1234567.wl123.sendgrid.net

The em record handles SPF for SendGrid's bounce address, so you don't need to add SendGrid to your own SPF record. Click Verify in SendGrid once the records are published.

Mailchimp

Authenticate your domain in Mailchimp's domain settings. Mailchimp asks for two CNAME records:

k2._domainkey.yourdomain.com  CNAME  dkim2.mcsv.net
k3._domainkey.yourdomain.com  CNAME  dkim3.mcsv.net

Mailchimp handles SPF with its own bounce domain, so you don't need to add it to your SPF record. Mailchimp also expects your domain to have a DMARC record.

Postmark

DKIM: in Postmark, open Sender Signatures (or your domain) and publish the DKIM TXT record it shows, for example:

20230601123456pm._domainkey.yourdomain.com  TXT  "k=rsa; p=MIGfMA0G..."

Return-Path: for SPF alignment, add a custom Return-Path CNAME:

pm-bounces.yourdomain.com  CNAME  pm.mtasv.net

With the custom Return-Path in place, you don't need to add Postmark to your root SPF record.

Salesforce

SPF: add include:_spf.salesforce.com. Other Salesforce products use their own includes: Marketing Cloud uses include:cust-spf.exacttarget.com, and Account Engagement (Pardot) uses include:aspmx.pardot.com.

DKIM: go to Setup → DKIM Keys, click Create New Key, choose a selector and your domain, publish the records Salesforce shows, and activate the key once they resolve.

Other Services

HubSpot, Zendesk, Brevo, Klaviyo and most other services have a domain authentication page that lists the DNS records to add. Publish every record it shows (usually DKIM CNAME records, sometimes a bounce-domain CNAME), then verify in the service.

Testing Before Enforcement

Before you move DMARC to p=quarantine or p=reject, check every service:

• [ ] SPF covers the services that need it
• [ ] DKIM is set up and verified for each service
• [ ] A test email from each service passes DMARC
• [ ] The service shows as passing in your MailShield reports

Test With the Deliverability Tester

1. Open Deliverability Tester in the sidebar and click Generate Test Address.
2. Send an email from the service to that address, for example a test campaign or a password-reset email.
3. When the results appear, check that SPF, DKIM and DMARC pass.
4. Repeat for each service.

See Deliverability Tester for details.

Check Your Reports

After a few days, open Reports in the sidebar. The Sending Sources table on the DMARC tab shows each source that sent mail as your domain and whether it passes.

Common Issues

SPF Record Too Long

SPF allows at most 10 DNS lookups per check, and every include counts. Record length matters too: a single TXT string holds at most 255 characters (longer records must be split into several quoted strings), and the whole record should stay small enough for the DNS answer to fit in 512 bytes.

Solutions:

• Remove includes for services you no longer use.
• Drop includes that don't help DMARC, such as a service that already uses its own bounce domain.
• Move some services to a subdomain with its own SPF record.
• Flattening (replacing includes with IP addresses) works, but breaks when the provider changes its IPs.

DKIM Not Signing

Symptom: DMARC reports show no DKIM result for the service, or DKIM for the service's own domain.

Causes: DKIM isn't turned on in the service, the DNS records aren't published, or the service signs with its own domain.

Fix: complete the service's domain authentication and check the records resolve.

Alignment Failures

Symptom: SPF or DKIM passes, but DMARC fails.

Cause: the service uses its own domain for the bounce address or the DKIM signature.

Fix: set up the service's custom bounce (MAIL FROM or Return-Path) domain and custom DKIM. Relaxed alignment, the DMARC default, already lets a subdomain such as bounce.yourdomain.com align with yourdomain.com. If your DMARC record sets aspf=s or adkim=s, the domains must match exactly.

SPF Record Examples

One provider:

v=spf1 include:_spf.google.com ~all

Several services:

v=spf1 include:_spf.google.com include:_spf.salesforce.com include:mail.zendesk.com ~all

Switch ~all to -all once your reports show that every legitimate source passes.

Next Steps

• Email Source Discovery: find all your senders
• DMARC Enforcement Roadmap: plan your enforcement