DNS Setup Guide

How to add DKIM, SPF, and DMARC records for your sending domain. Step-by-step for non-engineers, covering all major DNS providers.

This guide explains the three DNS records required to send email with Sendbound — what they are, why they matter, and how to add them at every major DNS provider.

Why DNS records matter

When an email lands in someone's inbox, the receiving mail server checks three things before deciding to accept or reject it:

Record	What it proves	What happens without it
DKIM	The email was cryptographically signed by you	Higher spam scores, some servers reject the email
SPF	Your domain authorized Sendbound to send on your behalf	Fails SPF check — feeds spam scoring
DMARC	How to handle emails that fail DKIM or SPF	Without DMARC, senders can spoof your domain

All three work together. A domain with all three configured correctly passes email authentication and lands in the inbox.

The records Sendbound gives you

When you add a domain in Settings → Domains, Sendbound generates three DNS records specific to your domain:

DKIM

Type:    TXT
Name:    abc123._domainkey.yourdomain.com
Value:   v=DKIM1; t=s; h=sha256; p=MIGfMA0GCSqGS...

The six-character prefix (e.g. abc123) is your DKIM selector — it is unique to your domain and generated automatically when you add the domain in Sendbound. Copy the exact record from Settings → Domains, not from this guide.

This is a public key. Sendbound signs every outbound email with the corresponding private key. Receiving servers verify the signature against this record to confirm the email wasn't tampered with.

SPF

Type:    TXT
Name:    yourdomain.com
Value:   v=spf1 include:sendbound.com ~all

Only one SPF record per domain. If you already have a TXT record starting with v=spf1, add include:sendbound.com to it — don't create a second record.

Correct: v=spf1 include:existing-provider.com include:sendbound.com ~all
Wrong: Two separate TXT records both starting with v=spf1

DMARC

Type:    TXT
Name:    _dmarc.yourdomain.com
Value:   v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none (report-only mode). Once your DKIM and SPF are verified and you've migrated fully to Sendbound, tighten the policy to p=quarantine or p=reject.

Adding records at common DNS providers

Cloudflare

Log in to dash.cloudflare.com
Select your domain → DNS → Records
Click Add record
For DKIM and DMARC: type = TXT, paste the Name and Content from the Sendbound dashboard
For SPF: find the existing v=spf1 TXT record → click Edit → add include:sendbound.com before ~all
Proxy status must be DNS only (grey cloud) for TXT records — not proxied

DNS propagation on Cloudflare is typically under 2 minutes.

AWS Route 53

Open the Route 53 console
Hosted zones → select your domain
Click Create record
Record type: TXT, paste Name and Value from the Sendbound dashboard
For DKIM: the Name field is your selector followed by ._domainkey — e.g. abc123._domainkey (Route 53 appends the zone automatically)
For DMARC: Name = _dmarc
TTL: 300 seconds is fine

GoDaddy

Log in to godaddy.com → My Products → Domains → Manage DNS
Click Add at the bottom of the records table
Type: TXT, Name: your DKIM selector + ._domainkey (e.g. abc123._domainkey — GoDaddy adds the domain automatically), Value: paste the DKIM value from the dashboard
For SPF: find the existing TXT record at @ → click the pencil icon → edit the value to include include:sendbound.com
For DMARC: Name: _dmarc, Value: paste the DMARC record value

GoDaddy propagation is typically 10–30 minutes.

Namecheap

Log in → Domain List → Manage → Advanced DNS
Click Add New Record
Type: TXT Record, Host: your DKIM selector + ._domainkey (e.g. abc123._domainkey), Value: paste DKIM from dashboard
For SPF/DMARC: same process with corresponding Host and Value fields
TTL: Automatic

Google Domains / Squarespace DNS

Open DNS settings for your domain
Click Manage custom records
Add a TXT record with the host and data from the Sendbound dashboard
For SPF: edit the existing v=spf1 record and add include:sendbound.com before ~all

Verifying your records

After adding the records, click Verify in Sendbound's domain settings. Sendbound checks all three records and shows the status of each.

You can also verify manually from the command line:

# DKIM — replace abc123 with your selector shown in Settings → Domains
dig TXT abc123._domainkey.yourdomain.com

# SPF
dig TXT yourdomain.com | grep spf

# DMARC
dig TXT _dmarc.yourdomain.com

DNS records propagate globally within a few minutes for most providers, but can take up to 48 hours in rare cases. If verification fails after 30 minutes, double-check that you didn't accidentally create a CNAME instead of a TXT record, and that there's only one SPF record.

Common mistakes

Mistake	Symptom	Fix
Two SPF records	SPF permerror, emails rejected	Merge into one TXT record
DKIM record as CNAME instead of TXT	Verification fails	Delete the CNAME, add a TXT record
Trailing dot in hostname	Verification fails on some providers	Remove the trailing dot from the Name field
Proxied (orange cloud) in Cloudflare	Verification fails	Set TXT records to DNS-only (grey cloud)
Wrong subdomain for DKIM	Verification fails	Name should be `<selector>._domainkey.yourdomain.com` — copy the exact selector from Settings → Domains in your dashboard

Tightening DMARC after migration

Once Sendbound is your only email provider and you've confirmed DKIM and SPF are passing, update your DMARC policy:

# Phase 1: monitoring (start here)
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

# Phase 2: quarantine (move failing emails to spam)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com

# Phase 3: reject (block failing emails entirely — maximum protection)
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Move through phases over 2–4 weeks, monitoring the DMARC reports at each stage before tightening further.

On this page