SPF, DKIM & DMARC for Drip.

Why authenticate Drip?

Authenticating in Drip is not optional housekeeping — Drip itself now requires it. Since February 1, 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same rules on Outlook.com in 2025. In response, Drip made a validated Custom Sending Domain plus a compliant DMARC record mandatory for all accounts — without them, your campaigns either get throttled or are sent on Drip's shared identity, where recipients see "via Drip.com," your From address does not align, DMARC cannot pass, and your reputation is pooled with every other unauthenticated account on the platform. Setting up the custom sending domain fixes all of it in one move: SPF and DKIM both align to your organizational domain, the "via" tag disappears, DMARC passes, and inbox placement is tied to your own sending history rather than a shared pool.

The SPF reality for Drip

Drip is a CNAME-based domain-authentication provider, so there is NO "include:..." mechanism for you to add to your root SPF record. When you add a Custom Sending Domain, Drip generates a return-path/bounce subdomain (for example em.yourdomain.com) as a CNAME that points into SendGrid's infrastructure — SendGrid then publishes the SPF record for that subdomain on its side. Because your envelope/MAIL FROM (Return-Path) uses that subdomain and it resolves into SendGrid's SPF-authorized space, SPF is satisfied there automatically, and DMARC still passes via relaxed SPF alignment (the subdomain shares your organizational domain). The practical consequence: do NOT add include:sendgrid.net (or any Drip include) to your root domain's SPF record. Drip does not ask for it, it would not help alignment, and it needlessly consumes one of your 10 SPF DNS lookups. Your root SPF stays exactly as it is; all of Drip's SPF authorization lives on the delegated subdomain.

Step by step

Records to add

Drip generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Drip's setup costs against that budget.

Check it actually worked

Verify in two places. First, inside Drip: Settings > Email Setup > Sending Domain shows a green checkmark against each of the three CNAMEs once they resolve — click Check Again after publishing, and allow 24-48 hours for DNS propagation before concluding anything is wrong. Second, from the recipient side: send a test to a Gmail account, open "Show original," and confirm SPF=PASS, DKIM=PASS, and DMARC=PASS with both mechanisms aligned to your domain, and that the "via Drip.com" note is gone from the From line. For an outside-in check, run your domain and the Drip selectors through an SPF/DKIM/DMARC checker or a full domain health check to confirm the records are visible and valid globally.

Common gotchas

• DNS setup

  Cloudflare orange cloud breaks authentication: proxied CNAMEs resolve to Cloudflare's edge instead of SendGrid, so Drip's checks never pass. Set every Drip CNAME to DNS-only (grey cloud).

• Coverage

  s1/s2 selector collision: if you already authenticate the same domain through SendGrid or another SendGrid-powered tool, the s1._domainkey and s2._domainkey records will conflict. Ask Drip support for custom selectors (e.g. drp/drp2) instead of overwriting the existing ones.

• DNS setup

  Don't add an SPF include to your root domain: Drip's SPF rides on the delegated return-path subdomain, so include:sendgrid.net on your root is unnecessary, won't improve alignment, and wastes one of your 10 SPF lookups.

• DNS setup

  Underscore CNAMEs: some registrars won't accept underscores (the _domainkey host) or won't let you point built-in subdomains to an external target. In those cases contact Drip support to request equivalent TXT/MX records as a workaround.

• DNS setup

  Duplicate DMARC records: only one _dmarc TXT is allowed. If you already have DMARC for another sender, edit the existing record — a second one invalidates both.

• DNS setup

  Propagation impatience: CNAMEs can take 24-48 hours to register. Red checkmarks immediately after publishing usually mean DNS hasn't propagated yet, not that the records are wrong.

• DNS setup

  Double-appended hostnames: many DNS panels auto-append your domain to the host field. Enter just s1._domainkey (not s1._domainkey.yourdomain.com.yourdomain.com), or the record won't resolve.

• DNS setup

  Skipping the return-path CNAME: it's easy to add the two DKIM records and forget the first (bounce) CNAME. Without it, DKIM may pass but SPF won't align, and Drip won't fully verify the domain.

Build your SPF record

Drip doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Drip SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.