SPF, DKIM and DMARC for Elastic Email

Short answer: Elastic Email mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain, add include:_spf.elasticemail.com to your one SPF record and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.

SPF	TXT at `@`	v=spf1 include:_spf.elasticemail.com ~all Elastic Email checks for `include:_spf.elasticemail.com` in your root SPF record: add just that include to the record you already have (its example also carries `a mx`, which you only need if your own web and mail servers send). DMARC passes through the aligned DKIM signature below.
DKIM	CNAME / TXT	TXT record at `api._domainkey` with the key from your account (it starts with `k=rsa;t=s;p=`). Tracking: CNAME `tracking` → `api.elasticemail.com`.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read, or a free report address that turns the reports into a dashboard; build your own.

Step by step

In Elastic Email open Settings → Domains → Manage Domains, click Start Verification, choose the domain option, enter your domain and click Continue.
Add the SPF include to your existing SPF record, and the DKIM TXT at api._domainkey using the Copy buttons (the key can change, so never reuse one from an old guide).
Add the tracking CNAME tracking → api.elasticemail.com.
Click Verify record, then View details to see SPF, DKIM, Tracking, MX and DMARC status. DNS changes can take up to 48 hours.
No DMARC record yet? Publish one at _dmarc with p=none and move to quarantine or reject once SPF and DKIM are valid.

Mistakes that break it

Sending from a subdomain such as news.example.com? The names become news, api._domainkey.news, tracking.news and _dmarc.news.
"Valid DKIM not found" usually means an old Elastic Email key is still in DNS, the panel shortened the value, or the domain was typed twice in the Name field.
If your DNS host appends your domain to CNAME values, enter api.elasticemail.com. with the trailing dot.
On Cloudflare, set the tracking CNAME to DNS only (grey cloud).
No green MX check is fine for a domain that only sends through Elastic Email.

Check that it worked

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

Other setup guides

Google Workspace Microsoft 365 Zoho Mail Hostinger Email Titan Email GoDaddy email (Microsoft 365 and Professional Email)Namecheap Private Email IONOS Mail Proton Mail Cloudflare Email Routing Mailchimp SendGrid Amazon SES Shopify Email Klaviyo HubSpot Brevo Mailgun Postmark Zendesk Constant Contact MailerLite Kit (ConvertKit)ActiveCampaign Freshdesk Intercom Zoho Campaigns Help Scout Squarespace Email Campaigns Mailjet Campaign Monitor Salesforce Account Engagement (Pardot)Wix Email Marketing (Ascend)Gorgias SparkPost Resend MailerSend