Email provider setup guides: SPF, DKIM and DMARC
The DNS records your email provider needs are in its documentation, scattered across several pages. These guides put them in one place per provider, show how to merge the SPF include into a record you already have without passing 10 lookups, and give DMARC a safe ramp-up.
Every value was read from the provider’s own documentation on 2026-11-10 and links its source. If you only need the quick answer for one record, the citations are shorter.
Not sure which providers send as your domain?
Scan your domain: the report lists the SPF includes, DKIM selectors and DMARC policy it finds, which tells you which guides below apply.
Free, no signup. The scan reads public DNS records only.
Mailbox providers
Where your people read and send mail. These need MX records on top of SPF, DKIM and DMARC.
- Google WorkspaceSPF include, a 2048-bit DKIM key from the Admin console, and a DMARC ramp-up.Setup guide
- Microsoft 365Two DKIM CNAMEs, the Exchange Online SPF include and a DMARC ramp-up that starts on subdomains.Setup guide
- Zoho MailRegion-specific MX and SPF values, a DKIM selector you choose, and a DMARC ramp-up.Setup guide
- Proton MailTwo MX records, one SPF include, three DKIM CNAMEs copied from the Domain names page.Setup guide
- FastmailTwo MX records, one SPF include and three fm1-fm3 DKIM CNAMEs.Setup guide
Sending services
Transactional and marketing senders that send as your domain. These are the ones that eat your SPF lookup budget or break DMARC alignment when set up half-way.
- Amazon SESEasy DKIM CNAMEs plus a custom MAIL FROM subdomain so SPF aligns for DMARC.Setup guide
- SendGridThree CNAMEs from Sender Authentication; no SPF include with automated security on.Setup guide
- MailgunSPF include (5 lookups), DKIM TXT from the control panel, and MX records you may not want.Setup guide
- PostmarkA DKIM TXT record and a pm-bounces Return-Path CNAME; no SPF include needed.Setup guide
- Mailchimp Transactional (Mandrill)A verification TXT, the mandrillapp.com include, mte1/mte2 DKIM CNAMEs and DMARC.Setup guide
What each SPF include costs in DNS lookups
SPF allows 10 DNS-querying terms per evaluation, nested includes counted (RFC 7208). Add the costs of every sender you use; if the total passes 10, receivers return a permanent error and SPF fails for all of them. Measured by querying DNS on 2026-11-10:
| Provider | Include | Lookups |
|---|---|---|
| Google Workspace | include:_spf.google.com | 1 |
| Microsoft 365 | include:spf.protection.outlook.com | 1 |
| Zoho Mail | include:zoho.com | 5 |
| Proton Mail | include:_spf.protonmail.ch | 2 |
| Fastmail | include:spf.messagingengine.com | 1 |
| Mailgun | include:mailgun.org | 5 |
| Mailchimp Transactional (Mandrill) | include:mandrillapp.com | 2 |
Providers change their records, so treat this as a snapshot and re-measure with the SPF checker. Over 10? See SPF flattening. Amazon SES, SendGrid and Postmark are not in the table because their standard setup does not put an include on your root domain.
Frequently asked questions
Which DNS records does an email provider need?
Mailbox providers need MX records so mail reaches you, plus SPF, DKIM and DMARC so receivers trust what you send. Sending services (transactional or marketing) usually need SPF or a return-path record and DKIM, and rely on your DMARC record.
Can I use more than one provider on the same domain?
Yes, and most domains do: a mailbox provider plus a transactional service, for example. You publish one SPF record that lists every sender, one DKIM key per sender (each with its own selector), and one DMARC record. Watch the 10 DNS lookup limit on SPF.
Why does each guide say which lookups an include costs?
SPF stops working with a permanent error above 10 DNS-querying terms, and nested includes count. Some provider includes cost one lookup, others cost five. Knowing the cost before you add a sender is what keeps the record valid.
How current are the DNS values on these pages?
Each value was read from the provider's own documentation on 2026-11-10, and every section links the page it came from. Where a provider issues the value per account, such as a DKIM key, the guide shows the form of the record and where to copy it from.