A cookie for product analytics
May we set a cookie to see which pages of DMARCLoop are used? It records the pages, never what's on them. Without it, visits are counted anonymously.
Sender library
Services we recognise in your reports, from their reverse DNS and the domains they sign or send with, and how to make each one pass DMARC. Always check the provider's own documentation: they change their setup steps from time to time.
Mailbox providers
| Sender | SPF | DKIM |
|---|---|---|
| Google Workspace | include:_spf.google.com | Generate a DKIM key in the Admin console (Apps > Google Workspace > Gmail > Authenticate email), publish the google._domainkey TXT record, then start authentication. |
| Microsoft 365 | include:spf.protection.outlook.com | Publish the two selector1/selector2 CNAMEs Microsoft Defender shows for the domain, then enable DKIM signing for it. |
| Zoho Mail | include:zohomail.com | Add a DKIM selector under Mail Admin > Domains > Email Configuration and publish the TXT record. |
Transactional email
| Sender | SPF | DKIM |
|---|---|---|
| Amazon SES | include:amazonses.com | Verify the domain in SES with Easy DKIM and publish its three CNAMEs. For aligned SPF as well, set a custom MAIL FROM domain under yours. |
| SendGrid | include:sendgrid.net | Authenticate the domain in SendGrid (Settings > Sender Authentication) and publish the CNAMEs it gives you; it then signs as your domain. |
| Mailgun | include:mailgun.org | Add your domain in Mailgun and publish the DKIM TXT record it shows; Mailgun signs as your domain once it verifies. |
| Postmark | include:spf.mtasv.net | Add the sender domain in Postmark and publish its DKIM TXT record, plus the Return-Path CNAME for aligned SPF. |
| SparkPost | include:sparkpostmail.com | Add the sending domain in SparkPost and publish the DKIM TXT record it generates. |
Marketing email
| Sender | SPF | DKIM |
|---|---|---|
| Mailchimp / Mandrill | include:servers.mcsv.net | Authenticate the domain in Mailchimp (Domains > Authenticate) and publish the k2/k3._domainkey CNAMEs it shows. |
| Brevo (Sendinblue) | include:spf.brevo.com | Authenticate the domain in Brevo (Senders, Domains & Dedicated IPs) and publish the DKIM record it shows. |
| Mailjet | include:spf.mailjet.com | Set up domain authentication in Mailjet and publish the mailjet._domainkey TXT record. |
| Constant Contact | include:spf.constantcontact.com | Turn on self-authentication in Constant Contact and publish the two DKIM CNAMEs it provides. |
| Adobe Marketo | include:mktomail.com | Add the domain under Admin > Email > DKIM and publish the TXT record Marketo generates. |
CRM
| Sender | SPF | DKIM |
|---|---|---|
| HubSpot | include:_spf.hubspotemail.net | Connect the email sending domain in HubSpot (Settings > Domains & URLs) and publish the hs1/hs2._domainkey CNAMEs. |
| Salesforce | include:_spf.salesforce.com | Create a DKIM key in Setup (DKIM Keys), publish both selector CNAMEs, then activate the key. |
Support desks
| Sender | SPF | DKIM |
|---|---|---|
| Zendesk | include:mail.zendesk.com | Enable digital signatures for the support address's domain and publish the zendesk1/zendesk2._domainkey CNAMEs. |
Business apps
| Sender | SPF | DKIM |
|---|---|---|
| Xero | – | Xero sends invoices and statements from its own servers. Add your domain under Settings > Email settings and publish the records Xero shows so its mail is signed as your domain. |
Filtering gateways (forwarders)
| Sender | SPF | DKIM |
|---|---|---|
| Mimecast | include:_netblocks.mimecast.com | Mimecast relays mail it filtered. Outbound through Mimecast, set up DNS authentication (DKIM) in its admin console for your domain. |
| Proofpoint | – | Mail through Proofpoint is usually a recipient's gateway forwarding it. If you send outbound through Proofpoint, enable DKIM signing for your domain there. |
| Cisco Secure Email | – | Usually a recipient's gateway forwarding your mail. For your own outbound through it, configure a DKIM signing profile for your domain. |