DMARC by platform

How do I set up DMARC for my email platform?

Each sender authenticates differently. Pick a platform for its SPF and DKIM records, where its alignment can catch you out, and the steps to p=reject.

Choose a platform

DMARC for Google Workspace

Google Workspace needs one SPF include on your domain and a DKIM key you generate in the Admin console. Mail is not signed with your domain until you turn that key on.

DMARC for Microsoft 365

Microsoft 365 needs one SPF include plus two DKIM CNAME records on each custom domain. Until DKIM is enabled for that domain, its mail is not signed with your domain.

DMARC for SendGrid

SendGrid domain authentication with automated security uses three CNAME records plus a DMARC TXT record. You do not edit your root SPF record, because SPF is handled on a SendGrid subdomain.

DMARC for Mailchimp

Mailchimp domain authentication asks for two DKIM CNAME records and a DMARC TXT record. Its setup article asks for no SPF change, so DKIM is the path to plan your alignment on.

DMARC for Mailgun

Mailgun verifies a sending domain with an SPF TXT record, a DKIM record from its control panel (TXT, or CNAME with Automatic Sender Security), two MX records and a tracking CNAME.

DMARC for Amazon SES

Amazon SES signs with Easy DKIM through three CNAME records. By default its MAIL FROM is on amazonses.com, so SPF cannot align until you set up a custom MAIL FROM domain.

DMARC for HubSpot

HubSpot asks for two DKIM CNAME records and an SPF TXT entry, all generated for your account during setup, plus a DMARC TXT record.

DMARC for Klaviyo

Klaviyo branded sending domains use NS records (dynamic routing) or CNAME records (static routing) on a sending subdomain, plus a TXT verification record at your root.

DMARC for Zoho Mail

Zoho Mail needs one SPF include and a DKIM TXT record at a selector you name in the admin console.

DMARC for GoHighLevel

A HighLevel LC Email dedicated sending domain uses five records: SPF and DKIM TXT, two MX records and a tracking CNAME, normally on a subdomain.

DMARC for Brevo

Brevo authenticates a domain with a Brevo code TXT record, DKIM and a DMARC record. Copy the exact DKIM records from your account, because the form depends on the setup.

DMARC for Postmark

Postmark uses a DKIM TXT record and a custom Return-Path CNAME. You do not add Postmark to your own SPF record: Postmark says that does nothing.

DMARC for Constant Contact

Constant Contact self-authentication generates CNAME or TXT records and DMARC policy details inside your account. The exact values are not published, so take them from there.

DMARC for Salesforce Marketing Cloud

Marketing Cloud Engagement authenticates through a Sender Authentication Package on a subdomain, either delegated to Salesforce with four NS records or self-hosted.

DMARC for Shopify

Shopify's domain authentication uses CNAME records shown in your admin, which handle both SPF and DKIM. You do not add a separate SPF TXT record for it.