Provider setup
27 articles
DMARC for Google Workspace
A new Google Workspace domain ships with no DKIM signing, an SPF record you must add yourself, and no DMARC policy at all. This guide walks the exact order to fix that: get SPF right under the 10-lookup limit, switch on DKIM in the Admin console, then ratchet DMARC from monitoring to full reject without breaking a single legitimate message.
Read more
DMARC for Microsoft 365
A practical, ordered guide to email authentication on Microsoft 365: build a complete SPF record for Exchange Online, enable DKIM signing with Microsoft's two selector CNAMEs, and walk DMARC safely from p=none through quarantine to p=reject without breaking your mail.
Read more
Amazon SES at scale: deliverability and DMARC
Amazon SES is deceptively easy to start with and deceptively hard to run well at volume. Verifying a domain, adding three DNS records and firing your first message takes an afternoon.
Read more
SendGrid dedicated IPs, authentication and reputation
Most teams reach for a SendGrid dedicated IP because someone told them shared IPs are bad, or because a deliverability vendor implied that owning your own IP is the professional thing to do.
Read more
DMARC for Mailchimp users: a deliverability checklist
If you send marketing email through Mailchimp, you sit in an awkward spot. You do not run your own mail servers, you do not control the IP addresses your campaigns go out on, and yet your From: address still says.
Read more
Email authentication for ActiveCampaign: SPF, DKIM and DMARC
An ActiveCampaign-specific guide to email authentication: the exact SPF include, CNAME-based DKIM, the custom return-path that aligns SPF, and a staged path to DMARC p=reject without breaking your campaigns or automations.
Read more
Email authentication for Amazon SES: SPF, DKIM and DMARC
Amazon SES passes SPF and DKIM by default but on amazonses.com, so nothing aligns under DMARC. Here is the exact SES include, Easy DKIM and its CNAME selectors, the custom MAIL FROM that fixes SPF alignment, and the staged path to p=reject.
Read more
Email authentication for Amazon WorkMail: SPF, DKIM and DMARC
Amazon WorkMail sends through SES, so its defaults quietly fail DMARC alignment. Here is the exact SPF include, the three Easy DKIM CNAMEs, the custom MAIL FROM domain that fixes SPF alignment, and the staged path to p=reject without an outage.
Read more
Email authentication for Brevo: SPF, DKIM and DMARC
A Brevo-specific guide to SPF, DKIM and DMARC: the exact spf.brevo.com include, both DKIM CNAME selectors, why the return-path means DKIM (not SPF) carries DMARC on shared IPs, custom return-path with a dedicated IP, and the staged path from p=none to p=reject without breaking delivery.
Read more
Email authentication for Constant Contact: SPF, DKIM and DMARC
Constant Contact sends your campaigns from its own servers under your brand's From address, so by default SPF and DKIM both align to Constant Contact, not you, and DMARC fails. This Constant Contact-specific guide covers self-authentication, the real ccsend.com DKIM CNAMEs, when SPF and a branded return-path matter, and the safe staged path from p=none to p=reject without losing a campaign.
Read more
Email authentication for Fastmail: SPF, DKIM and DMARC
A Fastmail-specific setup guide: the exact spf.messagingengine.com SPF include, the three fm1/fm2/fm3 DKIM CNAMEs, how return-path and DKIM alignment behave, and the safe path from p=none to p=reject.
Read more
Email authentication for Freshdesk: SPF, DKIM and DMARC
A Freshdesk-specific setup guide: the exact SPF include, the fdkim1 and fdkim2 DKIM CNAMEs, why the Return-Path means SPF will not align, and how to reach DMARC enforcement on support email without breaking ticket replies.
Read more
Email authentication for HubSpot: SPF, DKIM and DMARC
A HubSpot-specific guide to email authentication: the exact SPF include, HubSpot's two CNAME-based DKIM selectors, the custom bounce subdomain for return-path alignment, and how to take a HubSpot-sending domain from p=none to p=reject without breaking email.
Read more
Email authentication for Intercom: SPF, DKIM and DMARC
Intercom gives you both halves of DMARC: a DKIM CNAME and a custom return-path CNAME that makes SPF align. Here is the exact selector, the two records to publish, why you do not add an SPF include, and how to reach p=reject without breaking your onboarding, campaign or support email.
Read more
Email authentication for Klaviyo: SPF, DKIM and DMARC
A Klaviyo-specific guide to SPF, DKIM and DMARC: the exact _spf.klaviyomail.com include, the kl/kl2 DKIM selectors, the dedicated sending domain CNAMEs, custom return-path alignment, and the safe path from p=none to p=reject without losing a campaign or flow.
Read more
Email authentication for Mailchimp: SPF, DKIM and DMARC
A Mailchimp-specific guide to SPF, DKIM and DMARC: the exact mcsv.net include, how to publish Mailchimp's DKIM CNAMEs, why default bounce addresses break SPF alignment, and how to reach p=reject without losing a campaign.
Read more
Email authentication for Mailgun: SPF, DKIM and DMARC
A complete, Mailgun-specific walkthrough: the exact SPF include, how to enable and publish DKIM with Mailgun's real selector, why the default return-path breaks SPF alignment, and how to reach DMARC enforcement when sending through Mailgun's subdomain model without an email outage.
Read more
Email authentication for Mailjet: SPF, DKIM and DMARC
A Mailjet-specific guide to SPF, DKIM and DMARC: the exact spf.mailjet.com include and why you can skip it, the mailjet._domainkey DKIM record, why the bnc3.mailjet.com return-path breaks SPF alignment, how to set a custom return-path, and the staged path to p=reject without losing mail.
Read more
Email authentication for Mimecast: SPF, DKIM and DMARC
A Mimecast-specific guide to SPF, DKIM and DMARC: the exact regional includes, generating and publishing a DKIM key from the console, why return-path and From alignment behave differently behind a gateway, and how to reach p=reject without an email outage.
Read more
Email authentication for Postmark: SPF, DKIM and DMARC
A Postmark-specific guide to SPF, DKIM and DMARC: the exact spf.mtasv.net include, publishing the DKIM CNAME selectors, configuring a custom Return-Path for SPF alignment, and ramping safely from p=none to p=reject without breaking transactional mail.
Read more
Email authentication for Proofpoint: SPF, DKIM and DMARC
Proofpoint is a gateway, not an ESP, so it relays your mail from its own IPs and that quietly breaks SPF and DKIM alignment. This Proofpoint-specific guide gives the exact SPF mechanism for Essentials (a:dispatch-us.ppe-hosted.com) and the cluster include for Protection Server, the DKIM signing and selector workflow for both products, how the return path affects SPF alignment, and the staged path to p=reject with Proofpoint in front of Microsoft 365 or Google Workspace.
Read more
Email authentication for Proton Mail: SPF, DKIM and DMARC
A Proton Mail-specific guide to SPF, DKIM and DMARC on a custom domain: the exact _spf.protonmail.ch include, Proton's three rotating DKIM CNAME records, the return-path quirk that makes DKIM load-bearing for alignment, and a safe path to p=reject.
Read more
Email authentication for Salesforce: SPF, DKIM and DMARC
Salesforce is four senders, not one. Here are the exact SPF includes, how to generate and activate Salesforce DKIM CNAMEs, why bounce management breaks SPF alignment, and the staged path to p=reject across core, Marketing Cloud and Pardot.
Read more
Email authentication for SendGrid: SPF, DKIM and DMARC
A SendGrid-specific guide to SPF, DKIM and DMARC: the exact sendgrid.net include, Domain Authentication with the s1/s2 DKIM selectors, the custom return-path for SPF alignment, and the staged path to p=reject without breaking your mail.
Read more
Email authentication for SparkPost: SPF, DKIM and DMARC
A SparkPost-specific guide to SPF, DKIM and DMARC: the exact _spf.sparkpostmail.com include, the scph DKIM TXT record, the bounce-domain CNAME that makes SPF align, and how to reach p=reject without losing SparkPost mail.
Read more
Email authentication for Zendesk: SPF, DKIM and DMARC
Zendesk locks the Return-Path to its own domain, so SPF can never align and DKIM is the only mechanism that carries your DMARC pass. Here are the exact zendesk1 and zendesk2 CNAMEs, the mail.zendesk.com SPF include, the safe order of operations and how to reach p=reject without breaking support email.
Read more
Email authentication for Zoho Mail: SPF, DKIM and DMARC
A Zoho Mail-specific guide to SPF, DKIM and DMARC: the exact Zoho SPF include, how to generate and publish DKIM selectors in the Admin Console, the return-path and alignment quirks that decide whether DMARC passes, and a safe sequence from p=none to p=reject.
Read more