Integrations
SPF, DKIM and DMARC setup for every service that sends your mail
DMARC passes only when each sender is set up for your domain. Most domains send through a mailbox provider plus a few other services: a newsletter tool, a CRM, a help desk, a transactional API. Each guide below gives the exact SPF include, the DKIM records and the setting to change for one service, taken from that service's own documentation.
Mailbox provider
Google WorkspacePublish v=spf1 include:_spf.google.com ~all, a google._domainkey TXT key from the Admin console, then a _dmarc record. Both SPF and DKIM align.Setup guide Microsoft 365Microsoft 365 needs include:spf.protection.outlook.com, two DKIM CNAMEs at selector1 and selector2._domainkey, and a _dmarc TXT record.Setup guide Zoho MailZoho Mail needs v=spf1 include:zohomail.com ~all, a DKIM TXT key at a selector you name (such as zoho._domainkey) and a _dmarc record.Setup guide
Transactional email
Amazon SESAmazon SES aligns through three Easy DKIM CNAMEs. SPF aligns only with a custom MAIL FROM subdomain carrying an MX and include:amazonses.com.Setup guide SendGridSendGrid domain authentication adds three CNAMEs: em1234 for the return path and SPF, s1 and s2._domainkey for DKIM. Both align with relaxed DMARC.Setup guide MailgunMailgun needs v=spf1 include:mailgun.org ~all and a DKIM key on the sending domain, usually a subdomain like mg.example.com, plus a _dmarc record.Setup guide PostmarkPostmark needs a DKIM TXT record at a timestamped pm._domainkey selector and a pm-bounces CNAME to pm.mtasv.net for SPF alignment. No root SPF change.Setup guide
Marketing email
MailchimpMailchimp asks for two DKIM CNAME records (k2 and k3 under _domainkey) and one DMARC TXT record. It no longer asks for an SPF include.Setup guide BrevoBrevo needs a brevo-code TXT, DKIM as brevo1 and brevo2 CNAMEs (or one older TXT key) and a DMARC record. SPF only aligns with a branded subdomain.Setup guide
CRM and sales
HubSpotHubSpot needs two DKIM CNAMEs, an SPF include from your account, a DMARC record and no null MX. On shared IPs, DKIM is what aligns for DMARC.Setup guide SalesforceSalesforce DKIM uses two CNAMEs, one per selector, so it can rotate keys every 30 days. SPF uses include:_spf.salesforce.com.Setup guide
Help desk
ZendeskZendesk needs include:mail.zendesk.com in SPF and two DKIM CNAMEs, zendesk1 and zendesk2, then the Custom domain for DKIM switch turned on last.Setup guide FreshdeskOn Freshdesk mail servers, publish the 4 DKIM CNAMEs from Configure DKIM; SPF is then optional. With a custom mail server, your own SPF and DKIM apply.Setup guide
DNS host
CloudflareIn Cloudflare, add SPF at @ and DMARC at _dmarc as TXT records, and keep every DKIM or return-path CNAME on DNS only, never proxied.Setup guide GoDaddyIn GoDaddy DNS, enter only the prefix as Name: @ for SPF, _dmarc for DMARC, selector._domainkey for DKIM. Check first for GoDaddy's automatic DMARC record.Setup guide Amazon Route 53In Route 53, leave Record name blank for the root SPF record, type _dmarc for DMARC, and split DKIM keys over 255 characters into quoted strings.Setup guide
How DMARC+ uses these
DMARC+ reads the aggregate reports that receivers send for your domain and maps each sending IP to the service behind it. When a service shows up failing SPF or DKIM alignment, its guide here gives the DNS change that fixes it.