SPF, DKIM & DMARC for AWeber.
AWeber authenticates your domain the same way most modern email platforms do — through CNAME-based DKIM, not a pasted SPF line. Inside AWeber you open Domains and Addresses, click the gear icon next to your sending domain, and AWeber hands you three CNAME records to add at your DNS host. Those three CNAMEs delegate rotating DKIM keys back to AWeber so it can cryptographically sign every broadcast as your domain, and you publish one DMARC TXT record alongside them. There is no SPF include to add — AWeber deliberately relies on DKIM for alignment (more on that below). Once the CNAMEs resolve, AWeber signs with d=yourdomain.com, DKIM and DMARC pass, and the reputation you build belongs to your domain instead of AWeber's shared pool.
Why authenticate AWeber?
Authenticating your domain in AWeber is what decides whether your newsletters and automations reach the inbox. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass DKIM and publish a DMARC policy with alignment, and Microsoft began enforcing similar rules for Outlook.com in 2025. AWeber does light platform-level signing on its own domain automatically, but until you authenticate your own domain, your From address isn't cryptographically yours, DMARC can't pass on your name, and your sending reputation is pooled with every other unauthenticated account on AWeber's infrastructure. There's also a hard operational reason unique to AWeber: it re-checks your domain's authentication status every time you hit send, and per AWeber's own docs, if the records aren't resolving at that moment it returns the broadcast to Draft status instead of sending it. Getting DKIM and DMARC in place once removes the weak "via" attribution, lets DMARC pass, keeps your broadcasts from silently reverting to Draft, and accrues sender reputation to your domain.
The SPF reality for AWeber
AWeber does not give you an SPF include to add, and its own documentation is explicit about it — the AWeber Knowledge Base article is literally titled "Do I need to update my domain's SPF record? The answer is No." The reason is structural: every AWeber broadcast carries a Return-Path (envelope-from / bounce domain) on AWeber's own domain, not on yours. SPF is always evaluated against that envelope domain, so it authenticates AWeber, not you, and it can never align to your visible From domain. That's by design — AWeber leans entirely on DKIM alignment to satisfy DMARC, which is why the whole setup is CNAME-based DKIM with no shared include. Practical takeaway: adding include:send.aweber.com (or any AWeber mechanism) to your root SPF does nothing for alignment — AWeber says such a record will simply be ignored by mailbox providers, and it only consumes one of your 10 SPF lookups. Leave your existing SPF record alone: if you already publish v=spf1 include:_spf.google.com ~all for Google Workspace or an include for Microsoft 365, that's for your own mailbox host and should stay exactly as-is. Your DMARC pass for AWeber comes from DKIM, full stop.
Two ways to set it up
Automatic — Connect your domain
- From the gear icon, choose Automatically Connect Domain and sign in to your DNS provider
- AWeber writes the three DKIM CNAMEs (and the DMARC TXT) for you via the provider's API
- Covers over 40 supported DNS hosts (GoDaddy, Namecheap, Cloudflare, and more)
- Fewer chances to fat-finger a hostname or record type
Manual — add the records yourself
- Use this if your DNS host isn't in AWeber's supported list
- Copy the three DKIM CNAMEs and the DMARC TXT into your DNS zone by hand
- You control exactly how the host field is entered (bare vs fully-qualified)
- Same records, same result — just entered manually, then click to verify
Step by step
- 1
Add and verify your From address
Under your list's Settings, add the From address you'll send from — it must be on a custom domain you own (you@yourdomain.com), not a free @gmail.com/@yahoo.com/@outlook.com address. AWeber emails a confirmation link; click it to verify the address before you authenticate the domain.
- 2
Open Domains and Addresses
Go to your account menu, then Domains and Addresses. You'll see the domain from your verified From address listed here, with its current DKIM/DMARC status.
- 3
Reveal the DKIM and DMARC records
Click the gear (cogwheel) icon to the right of your domain to open the setup instructions. AWeber shows three CNAME records for DKIM plus a suggested DMARC TXT record, each with a copy button for the value.
- 4
Pick automatic or manual setup
If your DNS host is one of AWeber's 40+ supported providers, click Automatically Connect Domain and authorize the connection so AWeber writes the records for you. Otherwise, keep the values on screen and add them manually at your DNS host (next steps).
- 5
Add the three DKIM CNAME records
Create three records of type CNAME (not TXT or A): host aweber_key_a._domainkey points to aweber_key_a.send.aweber.com, aweber_key_b._domainkey to aweber_key_b.send.aweber.com, and aweber_key_c._domainkey to aweber_key_c.send.aweber.com. Match your registrar's host convention — some auto-append your domain, some want the fully-qualified name — and don't double the domain.
- 6
Publish the DMARC TXT record
Add a TXT record at host _dmarc with a value like v=DMARC1; p=none; rua=mailto:you@yourdomain.com; pct=100; — no surrounding quotation marks in the value field. Point rua at a mailbox you actually watch, not at AWeber's pre-filled feedback address. Skip creating a new record if you already have a _dmarc entry for another sender; a domain can only have one.
- 7
Let it propagate and re-check
DNS changes can take up to 48 hours. Return to Domains and Addresses and confirm the gear-icon status flips DKIM (and DMARC) to authenticated. AWeber also re-verifies automatically each time you send.
- 8
Confirm on a real message
Send a test to yourself, open it in Gmail then choose Show original, and check DKIM: PASS with d=yourdomain.com and DMARC: PASS. SPF showing an aweber.com domain (not yours) is expected and correct. Optionally run the domain through Qualisend's domain health check.
Records to add
AWeber generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| CNAME | aweber_key_a._domainkey | aweber_key_a.send.aweber.comDKIM key A — this is AWeber's fixed selector shape; add exactly as shown in your account |
| CNAME | aweber_key_b._domainkey | aweber_key_b.send.aweber.comDKIM key B (part of AWeber's automatic key rotation) |
| CNAME | aweber_key_c._domainkey | aweber_key_c.send.aweber.comDKIM key C (rotation) — add all three, type CNAME, never proxied |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:you@yourdomain.com; pct=100;DMARC policy — start at p=none and point rua at a mailbox you own (AWeber's on-screen default sends reports to its own feedback address); only one _dmarc record per domain |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what AWeber's setup costs against that budget.
AWeber's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.
DKIM
DKIM is the whole authentication story for AWeber. In Domains and Addresses, the gear icon next to your domain reveals three CNAME records with hostnames aweber_key_a._domainkey, aweber_key_b._domainkey, and aweber_key_c._domainkey, each pointing to the matching aweber_key_a.send.aweber.com / aweber_key_b.send.aweber.com / aweber_key_c.send.aweber.com target. AWeber uses three selectors instead of one specifically so it can rotate DKIM keys on a schedule (a to b to c) without you ever re-editing DNS — the private keys live with AWeber and it republishes the public key behind whichever selector is active. Because the selectors sit under _domainkey on YOUR domain, AWeber signs each broadcast with d=yourdomain.com, so DKIM aligns to your organizational domain and carries the DMARC pass. You never create or paste a DKIM TXT record or copy a public key by hand — you only add the three CNAMEs exactly as AWeber lists them (all type CNAME, not TXT or A) and let them resolve. Depending on your DNS provider you may need to append your domain to the host (aweber_key_a._domainkey.yourdomain.com) or leave it bare; AWeber and your registrar both flag this, and AWeber keeps a provider-specific tweaks list for the common hosts.
DMARC
Once DKIM is signing with your domain, publish a DMARC policy so mailbox providers know how to treat mail that fails, and so you start getting reporting. Add it as a single TXT record at host _dmarc (i.e. _dmarc.yourdomain.com), with no surrounding quotation marks in the value field. Start at p=none: it enforces nothing but turns on the aggregate (rua) XML reports, which is how you confirm AWeber is showing up as a DKIM-aligned, passing source before you tighten anything. One AWeber-specific catch: the DMARC example AWeber pre-fills on the gear-icon screen points rua at its OWN feedback address (v=DMARC1; p=none; pct=100; rua=mailto:dmarc@fbl.optin.com;), which means the reports flow to AWeber and never reach you. Swap that rua for a mailbox you actually watch (or a DMARC report analyzer) — for example v=DMARC1; p=none; rua=mailto:you@yourdomain.com; pct=100; — so you can read the data yourself. After a couple of weeks of clean reports, step the policy up to p=quarantine and eventually p=reject. One hard rule: a domain can have only one DMARC record — if you already publish _dmarc for another sender (Google Workspace, a transactional ESP, etc.), don't add a second; keep your existing record and just make sure AWeber is passing within it.
Check it actually worked
Don't trust the gear-icon status badge alone — confirm on a real message. Send yourself a test broadcast (or a quick message) from your authenticated From address, open it in Gmail, and choose the three-dot menu then Show original. You want DKIM: PASS with the signing domain (d=) showing yourdomain.com and DMARC: PASS. SPF will show an aweber.com domain rather than yours and won't align — that is expected and correct for AWeber, because DMARC is passing on DKIM alignment. Back in AWeber, the gear icon next to your domain should flip DKIM and DMARC to authenticated/verified once the CNAMEs resolve (allow up to 48 hours). You can also run your domain through Qualisend's domain health check to confirm all three DKIM CNAMEs and the DMARC TXT resolve, and once aggregate reports start arriving, drop one into the DMARC report analyzer to see AWeber listed as an aligned, passing source.
Common gotchas
- Coverage
Free-webmail From addresses are a dead end: AWeber won't let you build reputation on a @gmail.com, @yahoo.com, @aol.com or @outlook.com address, and Gmail/Yahoo's own DMARC policies will reject or spam-folder anything sent as their domains. You must send from a custom domain you control (you@yourdomain.com) — that's the domain these records authenticate.
- DNS setup
AWeber re-verifies at send time: it checks your domain's DKIM/DMARC status every time you send a broadcast, and if the records aren't resolving at that moment the broadcast is returned to Draft with a notification to re-authenticate, instead of going out. If a broadcast mysteriously reverts to Draft, check that your three CNAMEs still resolve — a DNS host migration or an accidentally deleted record is the usual cause.
- DNS setup
Host-suffix double-ups: some DNS hosts auto-append your domain to the host field, others expect the fully-qualified name. Entering aweber_key_a._domainkey.yourdomain.com on a host that auto-appends produces aweber_key_a._domainkey.yourdomain.com.yourdomain.com and silently fails. Match your registrar's convention — AWeber keeps a per-provider tweaks list for exactly this.
- DNS setup
Don't add an SPF include for AWeber. include:send.aweber.com won't align (the envelope-from is always AWeber's own domain), AWeber says it will be ignored by mailbox providers anyway, and it only consumes one of your 10 SPF lookups. Leave your root SPF as-is; AWeber's DMARC pass comes from DKIM, not SPF.
- DNS setup
On Cloudflare, add the three DKIM CNAMEs as DNS only (grey cloud), never proxied (orange cloud). A proxied CNAME won't resolve through to send.aweber.com and verification fails.
- DNS setup
AWeber's pre-filled DMARC value points rua at its own feedback address (dmarc@fbl.optin.com), so the aggregate reports go to AWeber, not you. Replace it with a mailbox you monitor (or a DMARC analyzer) before you publish, or you'll never see your reports.
- Breaks auth
One DMARC record per domain: if you already publish a _dmarc TXT for another sender, don't create a second one — a domain with two DMARC records is invalid. Keep your existing record and confirm AWeber passes within it.
- DNS setup
AWeber's Automatically Connect Domain shortcut only covers its 40+ supported DNS providers. If your registrar isn't on the list, the automatic flow won't work and you add the CNAMEs and DMARC TXT manually instead — same records, just entered by hand.
- Coverage
Propagation can take up to 48 hours. If the gear icon still shows unverified right after saving, wait and re-check before assuming the records are wrong.
Build your SPF record
AWeber doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listAWeber SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.