> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.supersend.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# DMARC/SPF Quickstart for Operators

# DMARC/SPF Quickstart for Operators

## Purpose

SPF, DKIM, and DMARC are DNS records that prove your domain is allowed to send email. If they're wrong or missing, providers like Gmail and Outlook treat your mail as suspicious — more spam folder, more bounces. This article gives you a practical checklist to verify and fix these records.

## Prerequisites

- Access to your DNS provider (GoDaddy, Cloudflare, your registrar, etc.)
- Your sending domain (e.g., `mail.yourcompany.com` or `yourcompany.com`)
- A basic idea of where SuperSend or your IT team expects records to go

## What Each Record Does (Plain English)

| Record | Role |
|--------|------|
| **SPF** | Tells receiving servers: "These IPs and hosts are allowed to send mail for my domain." |
| **DKIM** | Adds a cryptographic signature so receivers can verify the email wasn't tampered with. |
| **DMARC** | Tells receivers what to do when SPF or DKIM fail (e.g., reject, quarantine, or report). |

All three should be correctly set for good deliverability.

---

## Quick Checklist

### 1. Where to Add Records

Log in to your DNS provider and open DNS settings for your **sending domain** (the domain in the "From" address of your emails). For SuperSend-managed domains, you'll add records where SuperSend instructs during domain or mailbox setup.

### 2. SPF Record

- **Type:** TXT  
- **Name/Host:** `@` (for root domain) or your subdomain (e.g., `mail` for `mail.example.com`)  
- **Value:** Something like `v=spf1 include:_spf.example.com ~all` or `v=spf1 include:amazonses.com ~all` — your provider (SuperSend, SendGrid, etc.) will give you the exact string.  
- **Rule:** You should have **only one** SPF record per domain. If you already have one, you must add new "include" entries to that record instead of creating a second one.

**Common mistake:** Creating a duplicate SPF record. Multiple SPF records cause failures. Merge includes into a single record.

### 3. DKIM Record

- **Type:** TXT  
- **Name/Host:** A selector provided by your email provider (e.g., `s1._domainkey` or `google._domainkey`)  
- **Value:** A long string starting with something like `v=DKIM1; k=rsa; p=...`  

SuperSend and other providers generate this for you during domain setup. Copy it exactly. DNS propagation can take up to 48 hours.

### 4. DMARC Record

- **Type:** TXT  
- **Name/Host:** `_dmarc` (for `_dmarc.example.com`)  
- **Value example:**  
  `v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com`  

Start with `p=none` to collect reports without blocking. Once things look good, you can move to `p=quarantine` or `p=reject`.

**Tip:** The `rua` address receives aggregate reports. Use an email you monitor.

---

## How to Verify

1. **SuperSend Domains page** — Go to **Senders** → **Domains**. For each domain, check for green checkmarks or "Active" status. Warning icons mean something isn't right.
2. **External tools** — Use [mxtoolbox.com](https://mxtoolbox.com) or similar: check SPF, DKIM, DMARC. They'll show what’s published for your domain.
3. **Send a test email** — Send to a Gmail/Outlook address and inspect the headers (Show Original / View Source). Look for "SPF: PASS", "DKIM: PASS", and "DMARC: PASS".

---

## Common Problems

- **"SPF too many lookups"** — Too many `include:` statements. Consolidate or use a single ESP where possible.
- **"DKIM signature missing"** — The selector or value is wrong, or propagation hasn't finished. Wait 24–48 hours and recheck.
- **"DMARC not found"** — The `_dmarc` record isn't published. Add it. Even `p=none` is better than nothing.
- **Multiple SPF records** — Delete extras and merge into one record with all required includes.

---

## When to Escalate

If you've double-checked everything and deliverability is still poor:

- Run a [placement test](https://help.supersend.io/en/article/run-and-interpret-placement-tests-sleyma/) to see provider-specific results.
- Check [Understand Sender Health](https://help.supersend.io/en/article/understand-sender-health-3vg2oi/) for warming and health signals.
- Contact SuperSend support with your domain and any DMARC/SPF failure reports.

## Expected Result

You know what SPF, DKIM, and DMARC do, where to add them, and how to spot the usual mistakes. You can validate your setup via SuperSend and external tools.

## Related Articles

- [Domain Setup and DNS Checklist](https://help.supersend.io/en/article/domain-setup-and-dns-checklist-1ivzp11/)
- [Understand Sender Health](https://help.supersend.io/en/article/understand-sender-health-3vg2oi/)
- [Tracking Domains (Setup and Troubleshooting)](https://help.supersend.io/en/article/tracking-domains-setup-and-troubleshooting-4eoq85/)