SPF, DKIM and DMARC for SparkPost
Short answer: SparkPost mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain
and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.
| SPF | — | Not needed on your root domain when you set up a bounce domain: the bounce CNAME points to sparkpostmail.com, becomes the return-path and makes SPF pass and align. An old include:sparkpostmail.com on your root does nothing for mail with a SparkPost bounce domain. |
|---|---|---|
| DKIM | CNAME / TXT | TXT record at scphMMYY._domainkey on your sending domain (the selector carries a month and year, for example scph0624), value starting with v=DKIM1; k=rsa; h=sha256; p=. Bounce domain: CNAME to sparkpostmail.com (EU accounts: eu.sparkpostmail.com). |
| DMARC | TXT at _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comStart with p=none and a
mailbox you read, or a free report address that turns the reports into a dashboard; build your own. |
Step by step
- In SparkPost open Configuration → Domains (some accounts: Sending Domains), click Add a Domain and add the domain you send from, ideally a subdomain such as
mail.example.com. - Add the DKIM TXT record SparkPost shows, then verify the domain.
- Add a bounce domain, such as
bounces.example.com, with a CNAME tosparkpostmail.com(eu.sparkpostmail.comon SparkPost EU), and verify it. - Use that bounce domain as the default for your sending domain, or pass it as the return path when you send.
- No DMARC record yet? Publish one at
_dmarcon your root domain withp=none.
Mistakes that break it
- SparkPost Enterprise accounts point the CNAME at a tenant host like
yourname.mail.e.sparkpost.com, notsparkpostmail.com. - With strict alignment in SparkPost, the bounce domain must be the sending domain itself; relaxed allows a subdomain like
bounces.example.com. - Some DNS panels cut long TXT values: check that the saved DKIM key ends exactly as SparkPost shows it.
- Never use your root domain as the bounce domain: it can no longer receive normal mail.
- Bird's newer email API is a separate product with its own records; this guide is for SparkPost (app.sparkpost.com).
Check that it worked
After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.
Other setup guides
Google WorkspaceMicrosoft 365Zoho MailHostinger EmailTitan EmailGoDaddy email (Microsoft 365 and Professional Email)Namecheap Private EmailIONOS MailProton MailCloudflare Email RoutingMailchimpSendGridAmazon SESShopify EmailKlaviyoHubSpotBrevoMailgunPostmarkZendeskConstant ContactMailerLiteKit (ConvertKit)ActiveCampaignFreshdeskIntercomZoho CampaignsHelp ScoutSquarespace Email CampaignsMailjetCampaign MonitorSalesforce Account Engagement (Pardot)Wix Email Marketing (Ascend)GorgiasResend