How to set up SPF, DKIM, and DMARC in Squarespace

If your domain lives at Squarespace, setting up SPF, DKIM, and DMARC is entirely a DNS job — three TXT records you add in the same panel, one for each part of email authentication. The records themselves are identical to what you would publish on any host; what is Squarespace-specific is where the DNS editor lives and what you type in the Host field for each one. This guide walks through exactly that, including a note for anyone who registered their domain at Google Domains, since Squarespace absorbed that service in 2023 and now manages those domains under Squarespace Domains.

The short answer#

Email authentication is three separate DNS records, and on Squarespace all three are added the same way — as Custom Records of type TXT on the domain you manage there:

• SPF — one TXT record at the root of your domain. In Squarespace's Host field that is @. The value starts with v=spf1 and lists the services allowed to send as you.
• DKIM — a TXT record at a selector your email provider gives you. The Host field is <selector>._domainkey (for example s1._domainkey), and the value is a long public key that comes from your provider, not from you.
• DMARC — a TXT record at _dmarc. The value starts with v=DMARC1 and should begin life at p=none so you monitor before you enforce.

For the conceptual picture of how the three fit together, see the SPF, DKIM, and DMARC explainer. This article is the hands-on Squarespace version.

Where Squarespace keeps your DNS records#

Squarespace's DNS editor is not on your site — it is in your account settings, attached to the domain itself. The path is roughly:

Settings → Domains → select the domain → DNS Settings → Custom Records.

From there you add a record by choosing a Type (pick TXT), filling in the Host field, and pasting the record into the Data (value) field. That is the whole workflow, and it is the same three-field form for SPF, DKIM, and DMARC — only the Host and Data change.

A few things worth knowing before you start:

• The Google Domains migration. Squarespace acquired Google Domains in 2023, and registrations were transferred through 2023–2024. If you bought your domain at Google Domains, you now sign in at Squarespace to edit DNS. The record types are unchanged — Google Domains and Squarespace both expose plain TXT records — so nothing about SPF, DKIM, or DMARC is different; only the login and the menu labels moved.
• Labels drift. Squarespace has reorganized this area more than once, so the exact wording — "DNS Settings," "Custom Records," "Add Record" — may have moved or been renamed by the time you read this. The shape is dependable even when the labels are not: you are looking for the place to add a custom TXT record on the domain.
• The Host field is relative. You enter just the subdomain part — @, _dmarc, or <selector>._domainkey — and Squarespace appends your domain automatically. Do not type the full domain into the Host field.

Adding your SPF record in Squarespace#

SPF (Sender Policy Framework) is a single TXT record at the root of your domain that lists every server and service allowed to send mail using your name. When a receiver gets a message claiming to be from you, it checks the sending server against this list.

In the Custom Records form, add a record with Type TXT and Host @. The @ is Squarespace's shorthand for the domain root — the same place your website's main record lives. Paste your SPF string into the Data field. A typical value looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The include: entries name the mail services you actually use — your inbox provider, your marketing platform, your transactional sender — and ~all at the end soft-fails anything not listed. The exact includes depend on your own stack, so don't copy the example above verbatim. Instead, build the string from your real senders with the SPF record generator, which assembles a valid record and flags the mistakes that quietly break SPF.

The other limit to respect is the ten-lookup cap: SPF permits at most ten DNS lookups when it evaluates all your include: mechanisms, and stacking too many services blows past it. The generator counts these for you, which matters more than it sounds — an over-limit SPF record fails silently and you won't see it until mail starts landing in spam.

Adding your DKIM record in Squarespace#

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message you send, and the matching public key lives in DNS so receivers can verify it. Unlike SPF, the value here is not something you write — your email provider generates the key pair, keeps the private half, and hands you a public key and a selector to publish.

Enable DKIM in your sending platform first (Google Workspace, Microsoft 365, your ESP, your transactional provider). It will show you two things: a selector, which becomes part of the Host, and a long value beginning v=DKIM1. In Squarespace's Custom Records, add a TXT record where the Host is the selector followed by ._domainkey. So if your provider's selector is s1, the Host is:

s1._domainkey

Paste the provider's public key — exactly as given — into the Data field:

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...

A couple of Squarespace-specific cautions:

• Copy the selector precisely. Different providers use different selector names — google, selector1, s1, k1, dkim — and the record only works at the exact selector your provider expects. Type it into the Host field followed by ._domainkey, with nothing else appended.
• Some providers hand you a CNAME instead. A few platforms have you publish DKIM as a CNAME that points at a key they host, so it rotates automatically. If yours does, choose Type CNAME rather than TXT and paste the target they give you. Follow whatever record type your provider specifies.

DKIM is the sturdier of the two authentication checks because the signature travels with the message and survives forwarding, where SPF breaks. It is worth getting right.

Adding your DMARC record in Squarespace#

DMARC is the policy layer that ties SPF and DKIM to the visible "From" address, tells receivers what to do with mail that fails, and — crucially — sends you reports. It is a TXT record at the _dmarc hostname.

In Custom Records, add a TXT record with Host _dmarc. Squarespace appends your domain, giving _dmarc.yourdomain.com. Paste a starting value into the Data field:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The single most important detail is the policy tag. Start at p=none. That does not enforce anything — it tells receivers to take no action and simply send you the daily aggregate reports at your rua address. Those reports are how you discover which of your mail streams are and are not authenticating before you turn on enforcement. Publish p=reject on day one and you risk sending your own legitimate mail to spam.

Build your record with the DMARC record generator, then follow the ordered rollout in the how to set up DMARC guide: sit at p=none, read the aggregate reports until every legitimate source shows a DMARC pass with SPF or DKIM aligned, and only then step up to p=quarantine and eventually p=reject. As with SPF, publish one DMARC record only — a second at _dmarc invalidates both.

Verify the records resolve#

Squarespace saves DNS changes quickly, but the wider internet caches them, so allow anywhere from a few minutes to a few hours for the records to propagate before you judge whether they are live. Editing an existing record can take longer to refresh than adding a fresh one.

Once you have added all three, confirm they resolve and parse correctly with the SPF, DKIM, and DMARC checker. It looks up each record at your domain and tells you whether the syntax is valid, whether you have accidentally published two SPF records, and whether DMARC is present. If a record does not show up, the usual Squarespace culprits are a full domain typed into the Host field instead of the relative part, a duplicate @ SPF record, or simply propagation you have not waited out yet.

Getting these three records right is also what satisfies the Google and Yahoo sender requirements, which since 2024 have made SPF, DKIM, and DMARC mandatory for bulk senders. But remember the boundary: authentication proves who you are — it is the entry ticket to the inbox, not a guarantee of placement. That still depends on your sender reputation and list hygiene, which the deliverability guide covers in full.

Frequently asked questions#

Where do I set up SPF, DKIM, and DMARC in Squarespace?#

In your Squarespace account, go to Settings → Domains, select the domain, open its DNS Settings, and add a Custom Record of type TXT. You add three separate records: SPF with the Host field set to @, DKIM with the Host set to <selector>._domainkey, and DMARC with the Host set to _dmarc. Squarespace has reshuffled these menus before, so the exact labels may differ, but you are always looking for the place to add a custom TXT record on a domain managed at Squarespace. Domains that came over from Google Domains are managed here too.

What do I put in the Host field for each record?#

Enter only the relative part and let Squarespace append your domain. For SPF the Host is @, which means the root of your domain. For DMARC the Host is _dmarc. For DKIM the Host is your provider's selector followed by ._domainkey — for example s1._domainkey. Never type your full domain into the Host field, and never publish more than one SPF record or more than one DMARC record on the same domain, because a duplicate makes both invalid.

Where does the DKIM value come from?#

From your email provider, not from Squarespace and not from you. Enable DKIM in whatever platform sends your mail — Google Workspace, Microsoft 365, or your ESP — and it generates a key pair, keeps the private key, and gives you a selector plus a public key that starts with v=DKIM1. You publish that public key in Squarespace at the <selector>._domainkey Host, pasting the value exactly as the provider supplied it. Some providers ask you to publish a CNAME instead of a TXT record so the key can rotate automatically — if so, follow their record type.

Did my DNS move when Squarespace bought Google Domains?#

Yes. Squarespace acquired Google Domains in 2023 and migrated registrations through 2023–2024, so if you registered your domain at Google Domains you now manage its DNS inside your Squarespace account rather than the old Google Domains console. Nothing about the SPF, DKIM, or DMARC records themselves changed — they are still plain TXT records at the same hostnames — only the place you sign in to edit them.

Authentication tells mailbox providers your Squarespace mail is really yours, but a trusted identity only earns the inbox when the list behind it is clean. Run your addresses through the free email checker, or reach for the SPF and DMARC generators and the record checker to build and verify your records in a few minutes.