CORE MODULE

Configuring SPF, DKIM, and DMARC

What you'll learn in this guide

Get your email authentication set up properly so your messages land in inboxes, not spam folders. We'll walk through what SPF, DKIM, and DMARC actually do, why they matter, and the steps to configure them for a sending domain.

Overview

If you're sending email through CX Platform from your own domain — say news@yourcompany.com — you'll need to tell the wider email world that we're authorised to send on your behalf. That's what SPF, DKIM, and DMARC do. Together, they're the three records that mailbox providers like Gmail, Outlook, and Yahoo use to decide whether an incoming email is genuinely from you, or someone pretending to be.

Getting these set up isn't optional anymore. Major providers now require proper authentication for bulk senders, and missing records will either tank your deliverability or get your messages blocked outright. The good news is it's a one-off setup per domain, and once it's done you generally don't need to touch it again.

This guide covers the end-to-end process: adding your domain in CX Platform, requesting the authentication records, and applying them in your domain registry. If you haven't added your sending domain yet, take a quick detour to Managing Email Sending Domains first — that's where domains get registered before any of this configuration can happen.

SPF (Sender Policy Framework) tells mailbox providers which servers are allowed to send email from your domain. Think of it as a guest list.

‍DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send, so the receiving server can confirm the email hasn't been tampered with in transit.

‍DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It tells mailbox providers what to do if a message fails SPF or DKIM checks — typically reject it, quarantine it, or just report it.

‍

Before you start

You'll need access to your domain registrar or DNS provider — that's wherever the DNS records for your sending domain are managed (GoDaddy, Cloudflare, AWS Route 53, your internal IT team, and so on). If you're not sure who that is, check with whoever looks after your website. You'll also need permission to add or edit DNS records, since that's the final step.

Add your sending domain in CX Platform

The first step is to register the domain you want to send from. This happens in the Send module's domain settings — the full walkthrough is in Managing Email Sending Domains, but the short version is:

  1. In the secondary navigation menu, click Sending Domains to open the list of registered domains.
  2. Click Add New and enter the domain you want to send email from.
  3. Save the new domain. It'll appear in the list with a status indicating it's pending authentication.
  4. At this point the domain exists in CX Platform, but it isn't ready to send from yet. That happens once the records are in place.

‍

Request your SPF, DKIM, and DMARC records

The exact records you'll need are generated specifically for your domain and account, so the next step is to ask our support team to send them through.

  1. Raise a support ticket through the usual channel and ask for your SPF, DKIM, and DMARC records for the new domain.
  2. Include the domain name you've just added so support can match the request to the right account.
  3. Support will respond with the three records, formatted and ready to copy into your DNS.

‍

Tip
‍If you're setting up more than one sending domain, you can request the records for all of them in a single ticket. Just list each domain clearly so the right records come back against the right one.

‍

Apply the records in your DNS

  1. Log in to your DNS provider and find the DNS records or Zone editor for your sending domain.
  2. Add the SPF record as a TXT record on the root of your domain. Copy the value exactly as it appears in the support response.
  3. Add the DKIM record as a TXT (or CNAME, depending on what support sends you) record. This sits on a specific subdomain selector, which will be included in the record details.
  4. Add the DMARC record as a TXT record on _dmarc.yourdomain.com.
  5. Save the changes in your DNS provider.

DNS changes can take anywhere from a few minutes to 48 hours to propagate, though most providers update within an hour or two. Once the records are live, support can verify everything's resolving correctly and switch the domain to an active sending state.

‍

A couple of things to watch for
‍If you already have an SPF record on the domain (for example, for your day-to-day business email), don't add a second one — combine them into a single record instead. Two SPF records on the same domain will cause both to fail. Copy and paste the records rather than typing them out. A single missing character will break authentication, and these strings can get long.

‍

What's next

With your records in place and the domain verified, you're ready to start sending. From here, you can:

  • Link the new domain to an Application in Channel selection or Gateway settings, depending on how your sends are configured
  • Run a test send to confirm everything's flowing through correctly
  • Keep an eye on the DMARC reports you'll start receiving — they're a useful early warning system if anything ever goes wrong with authentication down the track

That's the whole setup — once it's done, you generally won't need to think about it again unless you change DNS provider, add another sending domain, or rotate keys for security.

‍

In this article

Article link for H2 class