DMARC/SPF Quickstart for Operators

Purpose

SPF, DKIM, and DMARC are DNS records that prove your domain is allowed to send email. If they're wrong or missing, providers like Gmail and Outlook treat your mail as suspicious — more spam folder, more bounces. This article gives you a practical checklist to verify and fix these records.

Prerequisites

• Access to your DNS provider (GoDaddy, Cloudflare, your registrar, etc.)
• Your sending domain (e.g., mail.yourcompany.com or yourcompany.com)
• A basic idea of where SuperSend or your IT team expects records to go

What Each Record Does (Plain English)

All three should be correctly set for good deliverability.

Quick Checklist

1. Where to Add Records

Log in to your DNS provider and open DNS settings for your sending domain (the domain in the "From" address of your emails). For SuperSend-managed domains, you'll add records where SuperSend instructs during domain or mailbox setup.

2. SPF Record

• Type: TXT
• Name/Host: @ (for root domain) or your subdomain (e.g., mail for mail.example.com)
• Value: Something like v=spf1 include:_spf.example.com ~all or v=spf1 include:amazonses.com ~all — your provider (SuperSend, SendGrid, etc.) will give you the exact string.
• Rule: You should have only one SPF record per domain. If you already have one, you must add new "include" entries to that record instead of creating a second one.

Common mistake: Creating a duplicate SPF record. Multiple SPF records cause failures. Merge includes into a single record.

3. DKIM Record

• Type: TXT
• Name/Host: A selector provided by your email provider (e.g., s1._domainkey or google._domainkey)
• Value: A long string starting with something like v=DKIM1; k=rsa; p=...

SuperSend and other providers generate this for you during domain setup. Copy it exactly. DNS propagation can take up to 48 hours.

4. DMARC Record

• Type: TXT
• Name/Host: _dmarc (for _dmarc.example.com)
• Value example:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

Start with p=none to collect reports without blocking. Once things look good, you can move to p=quarantine or p=reject.

Tip: The rua address receives aggregate reports. Use an email you monitor.

How to Verify

1. SuperSend Domains page — Go to Senders → Domains. For each domain, check for green checkmarks or "Active" status. Warning icons mean something isn't right.
2. External tools — Use mxtoolbox.com or similar: check SPF, DKIM, DMARC. They'll show what’s published for your domain.
3. Send a test email — Send to a Gmail/Outlook address and inspect the headers (Show Original / View Source). Look for "SPF: PASS", "DKIM: PASS", and "DMARC: PASS".

Common Problems

• "SPF too many lookups" — Too many include: statements. Consolidate or use a single ESP where possible.
• "DKIM signature missing" — The selector or value is wrong, or propagation hasn't finished. Wait 24–48 hours and recheck.
• "DMARC not found" — The _dmarc record isn't published. Add it. Even p=none is better than nothing.
• Multiple SPF records — Delete extras and merge into one record with all required includes.

When to Escalate

If you've double-checked everything and deliverability is still poor:

• Run a placement test to see provider-specific results.
• Check Understand Sender Health for warming and health signals.
• Contact SuperSend support with your domain and any DMARC/SPF failure reports.

Expected Result

You know what SPF, DKIM, and DMARC do, where to add them, and how to spot the usual mistakes. You can validate your setup via SuperSend and external tools.

Related Articles

• Domain Setup and DNS Checklist
• Understand Sender Health
• Tracking Domains (Setup and Troubleshooting)

Updated on: 17/03/2026