How do I add SPF DKIM and DMARC for an email sending API?

To add SPF, DKIM, and DMARC for an email sending API (like SendGrid, Mailgun, Amazon SES, Postmark, etc.), you typically need to configure records in your domain’s DNS so mail sent through the API is authenticated as coming from your domain.

1) SPF

SPF tells receiving mail servers which servers are allowed to send email for your domain.

What to do

Your email provider will give you an SPF record to add as a TXT record in DNS.

Example

v=spf1 include:spf.your-email-provider.com ~all

Important notes

• You should have only one SPF record per domain.
• If you already have one, merge the provider’s include: into it rather than creating a second SPF record.
• Example merge:

v=spf1 include:_spf.google.com include:spf.your-email-provider.com ~all

---

2) DKIM

DKIM signs outgoing mail with a cryptographic signature so recipients can verify it wasn’t altered and really came from your domain.

What to do

Your provider will usually ask you to add one or more DNS records, often CNAME or TXT records, for DKIM.

Example

You might be asked to add:

• selector1._domainkey.yourdomain.com
• selector2._domainkey.yourdomain.com

These may point to provider-hosted values like:

selector1._domainkey.yourdomain.com CNAME selector1.domainkey.provider.com

Notes

• Most providers generate the DKIM keys for you.
• Some use CNAME records, others use TXT records.
• DNS changes can take time to propagate.

---

3) DMARC

DMARC tells receiving servers what to do if SPF/DKIM fail and provides reporting.

What to do

Add a TXT record at:

_dmarc.yourdomain.com

Starter example

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Policy options

• p=none — monitor only
• p=quarantine — suspicious mail may go to spam
• p=reject — reject mail that fails DMARC

Suggested rollout

1. Start with p=none
2. Review reports
3. Move to p=quarantine
4. Then to p=reject when confident

---

4) Also set the “From” domain correctly

For authentication to work well:

• The From address should use your domain, like noreply@yourdomain.com
• If your API allows it, set a custom return-path / bounce domain too
• Avoid sending from a mismatch domain (like from@gmail.com via your API)

---

5) Typical setup process

1. Verify your domain with the email provider
2. Add SPF TXT record
3. Add DKIM CNAME/TXT records
4. Add DMARC TXT record
5. Wait for DNS propagation
6. Test by sending mail and checking headers/authentication results

---

6) How to check if it works

Send a test email to Gmail or Outlook and view the message headers. Look for:

• spf=pass
• dkim=pass
• dmarc=pass

You can also use tools like:

• MXToolbox
• Google Postmaster Tools
• Your provider’s domain authentication checker

---

7) Example DNS records

Here’s a generic example:

SPF

yourdomain.com TXT "v=spf1 include:spf.emailprovider.com ~all"

DKIM

s1._domainkey.yourdomain.com CNAME s1.domainkey.emailprovider.com
s2._domainkey.yourdomain.com CNAME s2.domainkey.emailprovider.com

DMARC

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

---

If you tell me which email API/provider you’re using and your DNS host (Cloudflare, Route 53, GoDaddy, etc.), I can give you the exact records to add.