SPF, DKIM, and DMARC record reference
Look up the DNS records that authenticate your sending domain so that subscribers' mail providers trust your Broadcasts. The exact hostnames and values are generated for your account, so treat the entries below as templates and copy the real values from your account's domain-authentication screen (confirm the exact values in your account).
Add these records at your DNS provider (or hand them to whoever manages DNS for your domain). Records usually take a few minutes to a few hours to propagate; authentication is verified only once the published values match.
Reference
| Record | Type | Host / Name | Example value | Purpose |
|---|---|---|---|---|
| SPF | TXT | send.yourdomain.com (your sending domain) | v=spf1 include:<your-account-spf-domain> ~all | Lists the servers authorized to send on your behalf. Merge the include: into any existing SPF record — keep only one SPF TXT per host. |
| DKIM (selector 1) | CNAME | <selector1>._domainkey.yourdomain.com | <selector1>.dkim.<your-account-domain> | Publishes a public key so receivers can verify the message signature. |
| DKIM (selector 2) | CNAME | <selector2>._domainkey.yourdomain.com | <selector2>.dkim.<your-account-domain> | A second selector supports key rotation without downtime. |
| DMARC | TXT | _dmarc.yourdomain.com | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com | Tells receivers how to handle mail that fails SPF/DKIM and where to send reports. |
| Tracking / link domain (optional) | CNAME | links.yourdomain.com | <your-account-tracking-host> | Serves branded click-tracking and unsubscribe links from your own domain. |
Notes
- One SPF record per host. DNS allows only a single SPF TXT record on a given name. If you already send from other services, combine all
include:mechanisms into one record rather than publishing several. - CNAME, not TXT, for DKIM. Using CNAME selectors lets your provider rotate keys for you. Do not flatten a CNAME into a copied TXT value unless your account screen explicitly provides a TXT key.
- Start DMARC at
p=none. Begin in monitor-only mode and review the aggregate (rua) reports before moving top=quarantineorp=reject. Enforce only after SPF and DKIM pass consistently. - Placeholders. Replace every
<…>token andyourdomain.comwith the exact host and value shown in your account. Trailing dots, subdomain casing, and selector names must match precisely. - Verification. After publishing, re-run the check on the domain-authentication screen. Records show as verified once the published DNS matches the expected values.
Related
Canonical terms: Author, Edition, Folder (Project Folder), Broadcast. See the Glossary.