Verify the sending domain (SPF, DKIM and DMARC)

Gmail, Outlook and other inbox providers check whether whoever sends an e-mail is allowed to use that domain. That proof lives in records in your domain's DNS. The sender domain must be verified at the provider (SPF and DKIM; DMARC recommended). Without it, Gmail and Outlook tend to refuse the e-mail or send it to spam.

The three recordsCopy Anchor Link

The exact SPF and DKIM values always come from your e-mail provider, on the screen where you add the domain. Copy them from there instead of building them by hand. The paths for each provider are on the SendGrid, Postmark, Mailgun, Resend and SMTP pages.

Step 1: add the domain at the providerCopy Anchor Link

1. In your e-mail provider, add the domain of the Sender e-mail.
2. Note down the records it shows: the name, type and value of each one.

Step 2: create the records in the DNSCopy Anchor Link

1. In the domain's DNS panel, create each record from step 1 exactly as the provider showed it.
2. Also create the DMARC record, if the domain does not have one yet.
3. Go back to the e-mail provider and ask it to verify. Propagation usually takes minutes, but it can take up to 48 hours.

Step 3: check in VipterCopy Anchor Link

1. Open the provider's page under General›Integrations›E-mail.
2. On the domain card, click Check domain. The check also runs on its own every time you save the provider.

The card shows three lines and the result in the corner:

1. The provider. Vipter asks the provider whether the domain is verified:
   • SendGrid: looks up domain authentication, if the API key has read access to Sender Authentication.
   • Mailgun: looks up the configured sending domain and checks that the sender is on that domain.
   • Resend: looks up the domain list, if the API key has Full access.
   • Postmark and SMTP: do not report it this way, and the line shows The provider does not report verification for this key.
2. SPF. Looks for a TXT with v=spf1 on the sender's domain. If the sender is on a subdomain, such as mail.yourdomain.com, Vipter also looks at the domains above it.
3. DMARC. Looks for a TXT with v=DMARC1 at _dmarc. on the sender's domain, going up the same way.

Vipter does not check DKIM, because the record name depends on a selector only the provider knows. The provider's verification is what confirms DKIM.

The result in the corner of the card:

Common problemsCopy Anchor Link

• SPF not found

  Some providers, such as SendGrid, Postmark and Resend, publish SPF on a return subdomain, not on the sender's domain. In that case the line looks like this even when everything is right: what counts is the provider showing the domain as verified. If the provider asks for SPF on the domain itself, create the record.

• Two SPF records on the same domain

  A domain can only have one TXT with v=spf1. With two, both stop working. Merge the include: entries into a single record.

• DMARC not found (recommended)

  Create the TXT at _dmarc.yourdomain.com with v=DMARC1; p=none; and click Check domain again.

• Could not look up SPF

  The DNS lookup failed at that moment. Try Check domain again in a few minutes.

• domain not added

  The sender's domain is not added at the provider. Add it in step 1, or change the Sender e-mail to an address on a domain that is already verified.

• the sender is not on the configured sending domain

  In Mailgun, use a sender on the sending domain itself. See connect Mailgun.

• The card shows verified, but e-mails land in spam

  Check that DMARC exists and that the text of your e-mails does not look like advertising. Sending to addresses that do not exist also hurts the domain: register the delivery status webhook so Vipter blocks those addresses.

What to do nextCopy Anchor Link

• Send a test e-mail from the provider's page and check that it arrives outside spam.
• Review which e-mails go out and the text of each one in General›Settings›E-mails.