Authenticating your domain (SPF, DKIM and DMARC)

Gmail, Outlook and every other inbox provider ask the same question about each email: did this really come from who it says? Authenticating your domain lets your email answer “yes”. It's a handful of DNS records, added once, and it's the single best thing you can do for getting your WordPress email into the inbox.

#The three records, in plain words

DKIM is a signature. SendWP signs every email it sends for you, and the DKIM record in your DNS lets the receiving server check that signature against your domain. If it matches, they know the email is genuine and wasn't changed on the way.

SPF is a guest list. It names the services allowed to send email for your domain, so a receiving server can check that SendWP is on the list.

DMARC is your policy. It tells inbox providers what to do with email that claims to be from your domain but fails those checks, and where to send reports about it. We suggest starting with a gentle policy that only asks for reports.

You don't need to understand any more than that. Your dashboard shows the exact records for your domain, and we check them for you.

#Add your records

1. Log in to your SendWP dashboard, open your site and go to Deliverability.
2. You'll see three cards: DKIM Record, SPF Record and DMARC Record. Each shows the record's name and value, with a button to copy them.
3. Go to wherever your domain's DNS is managed (often your domain registrar or web host) and add the DKIM and SPF records exactly as shown. Add the DMARC record too if your domain doesn't have one yet.
4. Back in SendWP, click Recheck DNS.

Each record shows Configured once we can see it, or Needs Setup while we can't. DMARC shows Recommended until it's in place. If the DKIM card shows a Validate DKIM button, click it once the record is configured.

DNS changes can take a little while to spread across the internet, from a few minutes to several hours. If a record still shows Needs Setup right after you add it, give it some time and click Recheck DNS again.

#What the records look like

Your dashboard always has the right values for your domain, so copy them from there. For a domain called yourstore.example, you'll see something like this:

Record	Type	Name	Value
DKIM	CNAME	sendwp._domainkey.yourstore.example	dkim.sendwp.com
SPF	TXT	@ (your domain itself)	v=spf1 include:spf.sendwp.com ~all
DMARC	TXT	_dmarc.yourstore.example	v=DMARC1; p=none; rua=mailto:dmarc@yourstore.example

#Tips for common DNS hosts

• Some hosts add your domain to the name for you. If your DNS host shows your domain after the name box, enter only the first part (for example sendwp._domainkey), or you'll end up with sendwp._domainkey.yourstore.example.yourstore.example.
• CNAME values go in as they are. Don't add http:// or anything else to them.
• Only one SPF record per name. If your domain already has a TXT record starting v=spf1, add include:spf.sendwp.com to it instead of creating a second one. Two SPF records on the same name cancel each other out.
• Only one DMARC record, too. If _dmarc already exists, keep the one you have unless you know you want to change it.
• Proxying off. If your DNS host offers to proxy a record (Cloudflare's orange cloud, for example), leave it off for these records.

#Spam complaints

The same Deliverability page has a Spam Complaints card: how many of the emails your site sent recently were marked as spam, rated Good, Needs Attention or Poor. If it isn't Good, look at which emails people are marking (your log flags each complaint) and write to us if you'd like a hand.

#Still stuck?

DNS can be fiddly, and you don't have to do it alone. Email support@sendwp.com with your domain and who hosts its DNS, and we'll help you through it.