Key Takeaways:
- Edit your existing SPF record to add the new tool. A second SPF record causes a permanent error, and neither record counts.
- Recount your SPF DNS lookups after every change. The limit is 10, and lookups nested inside includes count toward it.
- Set up custom DKIM on your own domain. The vendor’s default key signs with the vendor’s domain, which does not align with your From address.
- Check your DMARC policy before the first send. At p=reject, a half-configured tool will have its mail refused.
- Verify with a domain analyzer and a seed-inbox test, then watch DMARC reports for the first two weeks.
Every new marketing or support tool that sends email as you needs your domain’s permission to do it, and mailbox providers check for that permission on every message. If the DNS records behind the tool are missing or wrong, your first campaign from the new platform can land in spam or be rejected before anyone sees it.
This email authentication checklist covers what to set up, and in what order, before you send. It is tool-agnostic. The same steps apply whether you are adding Mailchimp, HubSpot, Klaviyo, Salesforce, Zendesk, or a smaller platform, because the DNS side of any new email service provider setup follows the same logic. Screens and field names differ from vendor to vendor, so each step describes what the record has to do rather than where to click.
A quick refresher helps. SPF lists the servers allowed to send mail for a domain, though you must keep an eye on your SPF lookup counter, as exceeding DNS’s strict 10-lookup limit will break your authentication. DKIM adds a signature that shows a message was authorized by the domain that signed it. DMARC checks that at least one of the two passes and matches the domain in the visible From address, then tells receivers what to do if neither does. Setting up SPF, DKIM, and DMARC for a new tool means getting all three to agree about the new sender.
Before You Start: Who Owns Your DNS?
A few answers up front can save you an afternoon of waiting on someone else.
- Find out who can edit DNS records. It might be your IT team, an agency, or whoever holds the registrar login. If the person who can publish records is not the person launching the campaign, get them involved now, because every step below depends on it.
- Decide which domain or subdomain the tool will send from. Pick the exact From address first. Every record you publish has to line up with it.
- Note every other tool already sending mail for the domain. That means your main mailbox provider, billing system, helpdesk, newsletter tool, and any old platform nobody switched off. You need this list when you edit SPF and again when you read DMARC reports later.
The Email Authentication Checklist, Step by Step
Work through these in order. Steps 1 to 6 are DNS and setup, step 7 is a compliance requirement, and steps 8 to 10 are verification.
Step 1. Add the Tool to Your Existing SPF Record
Edit it; do not create a second one. A domain gets one SPF record, a single TXT record that starts with v=spf1 and lists everything allowed to send for it. Your new vendor will give you an include value to add. Find the record you already have and insert the new include before the final ~all or -all, like this:
v=spf1 include:_spf.mailhost.example include:spf.newtool.example ~all
Some tools skip this step because they handle SPF on their own bounce domain (see step 6). Follow the vendor’s documentation and do not add an include you were not asked to add, since each one uses up lookups. The common mistake here is publishing the vendor’s snippet as a brand new TXT record, which leaves two SPF records on the domain.
Step 2. Check That You Are Still Under 10 DNS Lookups
SPF evaluation is capped at 10 DNS lookups. Every include, a, mx, ptr, exists, and redirect counts, and so does each lookup nested inside an include. The ip4, ip6, and all terms do not. Vendor includes often hide several lookups, so a record with five or six includes can already be at the limit. Run the record through an SPF lookup counter after you add the new tool. Many platforms, like PowerDMARC, offer this tool for free. The standard also advises stopping after two void lookups, which are lookups that return nothing, and those usually come from includes for tools you stopped using years ago. Remove them. The common mistake is counting includes by eye and stopping at seven.
Step 3. Set Up Custom DKIM Signing with Your Own Domain, Not the Vendor’s Default
The vendor gives you one or more DNS records, usually CNAME records and sometimes TXT, that publish a public key at a selector name under _domainkey on your domain. If the tool offers a key length, choose 2048 bits. Google requires at least 1024 bits for mail to personal Gmail accounts and recommends 2048. Publishing the record is only half the job. Most tools also need you to confirm the domain and switch signing on before they stop using their shared default. The common mistake is leaving the default in place because the first test email still arrives.
Step 4. Confirm Alignment
DMARC passes only when SPF or DKIM passes, and the domain it authenticated matches the domain in the From address. By default, DMARC uses relaxed alignment, so a signature from news.example.com lines up with a From address at example.com. Strict alignment needs an exact match. Send yourself a test message, open the raw headers, and compare the From domain with the DKIM signing domain (d=) and the SPF domain (the return-path). A message can show spf=pass and dkim=pass and still fail DMARC if neither domain matches.
Step 5. Check That Your DMARC Record Exists, and Which Policy It Uses
Look up the TXT record at _dmarc on your domain. The policy value changes the stakes. With p=none, receivers are asked to take no action on failures, so you mostly learn about problems through reports, although providers can still filter unauthenticated mail. With p=quarantine, failures are sent to spam, and with p=reject, they are refused. If your domain is already at reject, a half-configured new tool will have its mail turned away, so finish steps 1 to 4 before the first send. If there is no DMARC record at all, publish one at p=none with a reporting address. Google’s email sender guidelines require DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, allow the policy to be set to none, and recommend setting up SPF, DKIM, and DMARC for every domain regardless of volume.
Step 6. Set a Custom Return-Path or Bounce Domain If the Tool Supports It
SPF is checked against the return-path, also called the envelope sender, and not against the From address you see. If the tool uses its own bounce domain, SPF can pass for the vendor while failing to align with yours, which leaves DKIM carrying DMARC alone. A custom return-path is normally a CNAME on a subdomain of yours, such as bounces.example.com, pointed at the vendor. It also puts bounce handling under your own name. The common mistake is assuming SPF is finished once the include is in place.
Step 7. Configure One-Click Unsubscribe and a Visible Unsubscribe Link
Under Google’s sender guidelines, marketing and subscribed messages from senders above 5,000 messages a day to Gmail must support one-click unsubscribe and carry a clearly visible unsubscribe link in the message body. One-click works through two headers, List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click, following RFC 8058. Yahoo applies similar rules to bulk senders and expects opt-outs to be processed within two days. Most platforms add the headers for you, so open the raw headers of a test message and confirm they are there. Transactional mail such as password resets falls outside this rule. Smaller senders should still do it, because people who cannot find an unsubscribe link tend to click the spam button instead, and Google asks senders to keep their spam rate below 0.10% and never reach 0.30%.
Step 8. Verify Everything by Running the Domain Through a Domain Analyzer
A domain analyzer reads your published SPF, DKIM, and DMARC records in one pass and flags syntax errors, missing selectors, and lookup problems. The common mistake is trusting the green tick on the vendor’s setup screen. That tick usually confirms the vendor’s own records exist, not that the whole picture on your domain is correct.
Step 9. Send a Test to Seed Inboxes Before the Real List
Use an email deliverability tester or your own accounts at Gmail, Outlook, and Yahoo, then read the authentication results in the headers. You want SPF and DKIM passing, DMARC passing, and the domains aligned. If your domain has no history of sending at volume, Google also advises starting with engaged recipients and raising volume gradually instead of sending the full list on day one.
Step 10. Watch DMARC Reports for the First Two Weeks
Aggregate reports show every source sending mail as your domain and whether it passed. Look for the new tool and for anything unexpected. A source that fails here is easier to fix quietly in week one than after complaints arrive. Raw reports are XML files, so use a report reader instead of opening them by hand.
The Three Mistakes Behind Most First-Campaign Failures
If you only have time for three checks, make them these.
Two SPF records. Adding the vendor’s snippet as a new record feels natural, since the vendor’s instructions often read that way. But receivers expect exactly one SPF record per domain. With two, SPF evaluation returns a permanent error and neither record counts, which can quietly break authentication for every tool on the domain. Merge them into one.
DKIM signed by the vendor’s domain. Mail signed with the vendor’s default key passes DKIM, but the signing domain is the vendor’s, not yours. DMARC alignment then fails on the DKIM side, and if the return-path is also the vendor’s, it fails on the SPF side too. The campaign is authenticated on paper and unauthenticated as far as your domain is concerned.
SPF quietly breaking the 10-lookup limit. The record that worked last month can fail after one more include. The failure does not announce itself. Mail simply starts failing SPF, and it can go unnoticed until open rates drop. Count lookups after every change, and again whenever a vendor tells you they have updated their SPF include.
Should the New Tool Use a Subdomain?
Often, yes. A subdomain such as news.example.com gives marketing mail its own sending identity, so a rough campaign is less likely to drag down the reputation of the domain your staff uses for everyday mail. It also makes DMARC reports easier to read by mail stream.
A subdomain is not a shortcut, though. It needs its own SPF record and its own DKIM keys, because neither is inherited from the parent domain. DMARC works differently: a subdomain without its own DMARC record falls back to the parent domain’s policy. When a subdomain makes sense, and how to structure several of them, deserves a guide of its own.
Before You Hit Send
Go through the ten steps in order and treat step 9 as the gate. Send a test, open the raw headers, and check that SPF and DKIM pass, DMARC passes, and the signing and return-path domains match the From address. If one of those is off, fix it before the real list goes out. Then check your DMARC reports a few days after launch to see whether the new tool is passing on live traffic.
Frequently Asked Questions
Do I need to update SPF every time I add an email tool?
Not always. It depends on whether the tool sends using your domain in the return-path. Some tools use their own bounce domain, or ask for a CNAME on a subdomain instead. Follow the vendor’s instructions, and recount your lookups any time you do add an include.
What happens if I skip DKIM setup?
The tool will usually sign with its own default domain, which does not align with yours. DMARC then depends entirely on SPF, and SPF often breaks when mail is forwarded. Google also requires both SPF and DKIM from senders above 5,000 messages a day to Gmail.
How long do DNS changes take to work?
Sometimes minutes, but resolvers can keep serving the old record until its TTL runs out. Plan for a few hours, and leave a full day before a send that matters.
Can a new tool break email for the rest of my company?
Yes. A second SPF record or an SPF record over the lookup limit affects every message that relies on that record, including mail from your regular mailboxes. Changing the DMARC policy while a source is still failing can also get legitimate mail rejected.
Do I need DMARC if I send fewer than 5,000 emails a day?
Google’s formal DMARC requirement applies above that volume, but its guidelines recommend setting up SPF, DKIM, and DMARC for all domains. Microsoft’s consumer Outlook service has applied similar rules to senders above 5,000 messages a day since May 2025. A DMARC record is also the only way to get reports on who is sending as your domain.
Is p=none enough to start with?
For the bulk sender rules at Google and Microsoft, a policy of none is acceptable. It does not stop anyone from spoofing your domain, though. Once the reports show every legitimate source passing and aligned, you can move toward quarantine and then reject.
