SPF, DKIM & DMARC for DreamHost.

Why authenticate DreamHost?

Getting SPF, DKIM, and DMARC right on DreamHost decides whether your mail reaches the inbox. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook/Hotmail in 2025. DreamHost is unusual among "provider" pages because you send from your own mailboxes: the envelope sender is your domain, so SPF aligns, and DreamHost signs DKIM as your domain, so DKIM aligns too — a properly configured DreamHost domain passes DMARC on both mechanisms, the resilient setup that survives forwarding. But two DreamHost-specific things quietly break it: website scripts that send through PHP's mail()/sendmail instead of authenticated SMTP aren't DKIM-signed, and editing SPF drops DreamHost's managed record. Close both gaps and the sending reputation you build accrues to your own domain instead of leaking away as unauthenticated mail.

The SPF reality for DreamHost

DreamHost is a genuine "include" provider, but the include is really two includes plus mx, and together they ARE your whole root SPF record. For a domain whose DNS lives at DreamHost, the panel auto-publishes v=spf1 mx include:netblocks.dreamhost.com include:relay.mailchannels.net -all. netblocks.dreamhost.com holds DreamHost's own outbound IP ranges; relay.mailchannels.net is there because DreamHost routes outbound mail through MailChannels (a shared outbound relay) — both are required, and dropping either causes some of your mail to hard-fail SPF. Because you send from your own mailboxes, the SMTP envelope sender is an address on your domain, so SPF actually ALIGNS to your organizational domain here (unlike a Mailchimp or SendGrid that owns the Return-Path). The behavior that trips people up: this record is managed only as long as you don't touch it. Add or edit a custom SPF TXT record and DreamHost removes its auto-generated one, so your replacement MUST contain both include:netblocks.dreamhost.com and include:relay.mailchannels.net (plus any third-party include you're adding), all inside ONE v=spf1 record. The default ends in -all (hard fail), which is strict — every legitimate sender has to be listed or it's rejected outright. And never publish two SPF TXT records on the domain; two SPF records is itself a PermError.

Two ways to set it up

Step by step

Records to add

DreamHost generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what DreamHost's setup costs against that budget.

Check it actually worked

Don't trust the panel alone — confirm on a real message. Send a test from a DreamHost mailbox to a Gmail address, open it, and choose ⋮ → Show original: you want SPF: PASS showing your domain, DKIM: PASS with d=yourdomain.com and the selector dreamhost, and DMARC: PASS. If DKIM is missing, the message almost certainly went out via PHP mail()/sendmail rather than authenticated SMTP. You can spot-check the raw records with dig TXT dreamhost._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com, and confirm the SPF record still contains both includes with dig TXT yourdomain.com. Then run the domain through Qualisend's domain health check to confirm every record resolves and the SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — DreamHost (and its MailChannels relay) should show up as an aligned, passing source.

Common gotchas

• DNS setup

  Editing SPF removes DreamHost's managed record — the #1 DreamHost trap. The instant you save a custom SPF TXT, DreamHost drops its auto-generated one, so your replacement MUST contain both include:netblocks.dreamhost.com AND include:relay.mailchannels.net or some of your mail silently starts failing SPF.

• Coverage

  relay.mailchannels.net is not optional. DreamHost sends outbound mail through MailChannels, so mail routed through the relay hard-fails SPF if you leave that include out (the record ends in -all).

• Coverage

  Website mail via PHP mail()/sendmail isn't DKIM-signed. Only mail sent through authenticated SMTP (smtp.dreamhost.com) is signed; a WordPress form or PHP mailer without an SMTP plugin passes SPF but not DKIM, so it won't align on DKIM.

• Coverage

  The default -all is a hard fail, not a soft one. DreamHost's record rejects any sender you forget to include, so add every legitimate service before relying on it — or loosen to ~all while you test.

• DNS setup

  Automatic records only exist when your DNS is hosted at DreamHost. If your nameservers point to Cloudflare or a registrar, DreamHost publishes nothing — you must add the SPF record, copy the dreamhost._domainkey DKIM TXT, and add DMARC at your real DNS host yourself.

• Breaks auth

  Never publish two SPF records. If you add another mail service, merge its mechanism into the single v=spf1 line — two separate SPF TXT records is a PermError that breaks SPF entirely.

• Coverage

  Leave the Name field blank for the root SPF. DreamHost represents the domain root with an empty Name field; entering @ or your domain name doubles it into an invalid host.

• Coverage

  DMARC is on you. DreamHost auto-handles SPF and DKIM but never creates DMARC — without a _dmarc record you fail the Gmail/Yahoo bulk-sender requirements even though SPF and DKIM pass.

Build your SPF record

DreamHost is pre-selected below. Add any other platforms you send through, then publish the single merged record.

DreamHost SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.