Do I need to add an SPF record or include:amazonses.com for EmailOctopus?

Not for the native (Verify domain) setup. EmailOctopus publishes SPF behind your eom.yourdomain.com mail-from subdomain, so the CNAME you add is enough and SPF aligns to your domain automatically — you leave your root SPF untouched. You only add include:amazonses.com if you use EmailOctopus Connect and send through your own Amazon SES account, in which case you manage that domain's SPF yourself.

Why does my domain say "Partially verified"?

That status means the four CNAMEs (three DKIM selectors + the eom mail-from subdomain) resolved and DKIM and SPF are set up, but the DMARC TXT record is still missing. Add the generated record at _dmarc.yourdomain.com (e.g. v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com), then click Complete verification again — the status flips to Verified. Until you do, some strict receivers may still block or filter your mail.

What's the difference between verifying an email address and verifying a domain?

Verifying a single email address only authorises that one From address to send — it publishes no DKIM signing, no SPF alignment, and no DMARC, similar to a SendGrid Single Sender. Verifying the domain is what publishes the three DKIM CNAMEs, the eom mail-from subdomain, and the DMARC record, so your mail is cryptographically signed as your domain, passes DMARC, and you can send from any address at the domain. Always choose Verify domain.

Native EmailOctopus vs EmailOctopus Connect — which authentication setup do I use?

Native (the Verify domain flow on this page) is the default almost everyone uses: EmailOctopus provisions the four CNAMEs and the DMARC TXT and manages SPF behind the eom subdomain, so you never touch include:amazonses.com. EmailOctopus Connect is a separate path where you plug in your own Amazon SES account and EmailOctopus is just the campaign UI — there you configure SES Easy DKIM, a custom MAIL FROM subdomain, and include:amazonses.com on that domain's SPF yourself in the AWS console. If you're not already running SES, use Native.

Can I set my DMARC policy to strict SPF (aspf=s)?

You can, but there's no benefit and a small downside. Native EmailOctopus signs with SES Easy DKIM at d=yourdomain.com, which aligns strictly, so DMARC passes on DKIM regardless. SPF only aligns in relaxed mode because your envelope domain is the eom.yourdomain.com subdomain, not the bare root. Set aspf=s and the eom envelope stops aligning — DKIM still carries the pass, so nothing breaks, but you lose your second passing mechanism for no reason. Leave aspf relaxed; adkim=s (strict DKIM) is safe.

Do I still keep my own SPF record for Google Workspace or Microsoft 365?

Yes — keep it, and don't touch it for EmailOctopus. Your root v=spf1 record is for the senders that put your bare domain in the Return-Path: Google Workspace, Microsoft 365, a transactional relay, your help desk. EmailOctopus doesn't use your root SPF at all — its envelope lives on the eom subdomain with its own SPF — so there's nothing to merge and nothing that counts against your 10-lookup SPF limit.

SPF setup guide

SPF, DKIM & DMARC for EmailOctopus.

EmailOctopus authenticates your domain through its "Verify domain" flow, not by having you paste a shared SPF line. Because EmailOctopus sends on Amazon SES under the hood, running verification generates four CNAME records plus one DMARC TXT record: three of the CNAMEs are SES Easy-DKIM selectors that delegate rotating DKIM keys back to Amazon, and the fourth is a mail-from subdomain (eom.yourdomain.com) that becomes your Return-Path and quietly makes SPF align to your domain. Once those resolve and you click Complete verification, EmailOctopus signs mail as your own domain, DMARC passes on both SPF and DKIM, and the "via" notice Gmail attaches to unauthenticated mail disappears. There is no include:amazonses.com to add to your root SPF — EmailOctopus handles SPF on its end behind the eom subdomain.

CNAME domain authentication

Your DNSAdd the CNAME / TXT records

EmailOctopusSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate EmailOctopus?

Verifying your domain in EmailOctopus is the single biggest lever you have on inbox placement, and it is now effectively required for serious sending. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, Microsoft extended the same rules to Outlook/Hotmail/Live in 2025, and EmailOctopus itself blocks campaigns sent from free public From addresses like gmail.com or yahoo.com. Until you verify your domain, EmailOctopus sends under a shared, unbranded identity: recipients see the mail isn't cryptographically yours, your From address doesn't align, DMARC can't pass, and your sending reputation is pooled with every other unauthenticated sender on the shared infrastructure. Domain verification fixes all of it in one flow — Easy DKIM signs as d=yourdomain.com, the eom mail-from subdomain gives you a relaxed SPF pass that aligns to your organizational domain, DMARC passes on both mechanisms, and the reputation you build accrues to your own domain instead of the shared pool.

The SPF reality for EmailOctopus

EmailOctopus is a CNAME-based domain-authentication provider running on Amazon SES, so for your root domain there is NO include:amazonses.com to add — and this is the part almost every old tutorial gets wrong. When you verify, EmailOctopus provisions a mail-from subdomain in the form eom.yourdomain.com and asks you to publish it as a single CNAME pointing into its Amazon SES infrastructure. That subdomain becomes the envelope sender / Return-Path for your campaigns, and EmailOctopus publishes the underlying SPF record behind it — that's exactly what "we take care of the SPF record on our end" means. Because the envelope domain (eom.yourdomain.com) is a subdomain of your organizational domain, SPF passes AND aligns under DMARC's default relaxed alignment, so unlike Mailchimp (whose Return-Path lives on an mcsv.net domain that never aligns), EmailOctopus actually gives you an aligned SPF pass on top of DKIM. The catch: SPF alignment is relaxed only — the envelope is eom.yourdomain.com, not the bare yourdomain.com — so a DMARC policy set to strict SPF (aspf=s) drops the SPF alignment leg. Nothing actually breaks if you do (Easy DKIM still aligns strictly and carries the DMARC pass on its own), you just gain nothing and lose your second passing mechanism, so keep aspf relaxed (the default). You do NOT paste include:amazonses.com onto your root SPF for native EmailOctopus; doing so burns one of your 10 SPF lookups and does nothing for DMARC alignment. The include:amazonses.com mechanism only comes into play on the separate "EmailOctopus Connect" path, where you send through your OWN Amazon SES account and manage SES's SPF, Easy DKIM, and custom MAIL FROM yourself. Reserve your root SPF record for the senders that actually put your bare domain in the Return-Path (Google Workspace, Microsoft 365, a transactional relay) and let the eom subdomain + DKIM do the work for EmailOctopus.

Two ways to set it up

Recommended

Native EmailOctopus — Verify domain (recommended)

EmailOctopus manages SPF behind the eom mail-from subdomain and rotates Easy DKIM keys via CNAMEs — you never re-edit DNS
Adds zero DNS lookups to your root SPF; there's nothing to merge into your existing v=spf1 line
Four CNAMEs plus one generated DMARC TXT, all shown ready-to-copy in your account
Gives you aligned SPF (relaxed) plus aligned DKIM (strict), so DMARC passes on both mechanisms

Legacy

EmailOctopus Connect — your own Amazon SES account

You send through your own AWS/SES account and manage authentication in the AWS console yourself
You add SES Easy DKIM CNAMEs, a custom MAIL FROM subdomain, and include:amazonses.com to that domain's SPF
You publish and ramp the DMARC policy for each SES sending domain yourself
Only worth it if you already run Amazon SES and want EmailOctopus purely as the campaign UI

Step by step

In EmailOctopus

1
Open the Senders screen
Log in and go to your account's Senders screen (Settings → Senders). This is where every From identity — single email addresses and full domains — is managed. Click Verify new sender to start.
2
Choose "Verify domain (recommended)"
You'll be offered two options: verify a single email address, or verify a domain. Pick Verify domain (recommended) — only the domain path sets up DKIM, SPF, and DMARC and lets you send from any address at the domain. Verifying just an email address authorises one From address but gives you no domain-level authentication or alignment.
3
Enter your domain and Start verification
Type your sending domain (e.g. yourdomain.com) and click Start verification. EmailOctopus generates the records for your account: four CNAME records and one TXT record. It also derives the mail-from subdomain eom.yourdomain.com — the CNAME that becomes your Return-Path. Leave this screen open; you'll copy the exact names and values from here.

In your DNS

4
Add the eom mail-from CNAME
At the host that manages your DNS (usually your registrar), create the CNAME for the eom subdomain exactly as EmailOctopus shows it. This subdomain is your envelope/Return-Path and is what makes SPF align — EmailOctopus publishes the SPF behind it, so you never add include:amazonses.com yourself. Keep the record type as CNAME; don't change it to A or TXT.
5
Add the three DKIM CNAMEs
Create the three DKIM selector CNAMEs. Because EmailOctopus runs on Amazon SES, these are SES Easy-DKIM records: each host is a long token ending in ._domainkey and each value ends in .dkim.amazonses.com. Copy the token/target pairs exactly as shown — the three selectors let SES rotate your keys without you ever touching DNS again.
6
Add the DMARC TXT record
EmailOctopus also generates a DMARC policy record. Add it as a TXT record at host _dmarc with a value like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Skip creating a second one if a _dmarc record already exists — a domain must have exactly one. Without this record EmailOctopus leaves the domain "Partially verified."
7
Fix host doubling and the Cloudflare proxy
If your registrar auto-appends the domain, enter just the label (eom, or the token._domainkey selector) rather than the full eom.yourdomain.com, or you'll get eom.yourdomain.com.yourdomain.com — EmailOctopus's own tip if verification stalls is to strip the .yourdomain.com. On Cloudflare, set every CNAME to "DNS only" (grey cloud); an orange-cloud proxied CNAME won't resolve to amazonses.com and verification fails.

Verify

8
Click Complete verification
Back in EmailOctopus, click Complete verification (top right). DNS can take several hours to propagate; the status flips from Partially verified to Verified once all four CNAMEs and the DMARC TXT resolve. If it stalls, re-check the exact names/values and that no record is proxied.
9
Send from the verified domain and read the headers
Set your campaign and audience From address to one on the verified domain (e.g. news@yourdomain.com) — verifying DNS doesn't change a campaign already set to a different From. Then send yourself a test, open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS, DKIM: PASS with d=yourdomain.com, and DMARC: PASS, all aligned to your domain.

Records to add

EmailOctopus generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
CNAME	eom	1a2b3c4d.eom.emailoctopus-sends.comIllustrative — mail-from / Return-Path subdomain; EmailOctopus/Amazon SES publish the SPF behind it, which is what makes SPF align. Copy the exact target from your account and keep it permanently.
CNAME	abcdef1234567890._domainkey	abcdef1234567890.dkim.amazonses.comIllustrative — DKIM selector 1 (Amazon SES Easy DKIM, auto-rotated). Use the exact token/target shown in EmailOctopus.
CNAME	ghijkl0987654321._domainkey	ghijkl0987654321.dkim.amazonses.comIllustrative — DKIM selector 2. The three selectors let SES rotate keys without you re-editing DNS.
CNAME	mnopqr1122334455._domainkey	mnopqr1122334455.dkim.amazonses.comIllustrative — DKIM selector 3. Publish all three exactly as your account shows them.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comEmailOctopus generates this — required for a fully "Verified" status (missing it = "Partially verified"). One DMARC record per domain; start at p=none, then tighten.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what EmailOctopus's setup costs against that budget.

SPF 10-lookup budget0 used · 10 free

EmailOctopus's recommended setup adds 0 lookups — all 10 stay free for the senders that do need an include.

DKIM

DKIM for EmailOctopus is Amazon SES Easy DKIM, delivered as three CNAME records rather than a TXT key you paste. Each CNAME has a long random-token host ending in ._domainkey.yourdomain.com and a value ending in .dkim.amazonses.com — for example <token>._domainkey.yourdomain.com → <token>.dkim.amazonses.com. Because these are CNAMEs delegated to Amazon, SES holds the private keys and uses the three selectors to rotate the published keys on its own; you never generate a key, copy a public value, or re-edit DNS. Once all three resolve and you click Complete verification, EmailOctopus signs every campaign with d=yourdomain.com, so DKIM aligns strictly to your organizational domain and can carry a DMARC pass by itself — which matters because DKIM (unlike SPF) survives message forwarding through mailing lists and .forward rules. Two practical notes: keep the record type as CNAME (a TXT in a selector's place breaks validation), and if your DNS is on Cloudflare set each selector to "DNS only" (grey cloud) so it resolves to the amazonses.com host. You don't manage key length or rotation — that's handled on the SES side. (This is the native path; on EmailOctopus Connect you instead enable Easy DKIM inside your own AWS/SES console and publish those CNAMEs yourself.)

DMARC

DMARC is a policy TXT record published at _dmarc on your domain, and EmailOctopus is unusually helpful here: its verification flow generates the record for you and treats it as mandatory. If you publish the four CNAMEs but skip the DMARC TXT, EmailOctopus shows the domain as "Partially verified" — DKIM and SPF are live but the domain isn't fully authenticated, and strict receivers may still block your mail. Add the TXT at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery while you watch the aggregate (rua) reports to confirm EmailOctopus is passing SPF and DKIM aligned to your domain. Because native EmailOctopus gives you both a relaxed SPF alignment (via the eom mail-from subdomain) and strictly aligned Easy DKIM, you should see clean passes on both mechanisms quickly. Keep exactly one _dmarc record for the whole domain no matter how many senders you use — never add a second one specifically for EmailOctopus — and once alignment is consistent, ramp the policy from p=none to p=quarantine and eventually p=reject. One alignment caveat: leave aspf at its relaxed default. Setting aspf=s (strict SPF) stops the eom envelope from aligning — your envelope domain is eom.yourdomain.com, not the bare yourdomain.com — so you'd discard the SPF leg and lean entirely on DKIM for the pass; DMARC still passes, but there's no upside. adkim=s (strict DKIM) is safe, since EmailOctopus signs as your exact domain.

Check it actually worked

Don't trust the "Verified" badge alone — confirm it on a real message. Send yourself a test campaign (or a test from the verified From address), open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS, DKIM: PASS with signed-by / d=yourdomain.com (not amazonses.com or emailoctopus.com), and DMARC: PASS, all showing your own domain. In EmailOctopus, the Senders screen should read Verified rather than Partially verified (Partially verified means the DMARC TXT is still missing). You can spot-check the raw records with dig CNAME eom.yourdomain.com, dig CNAME <token>._domainkey.yourdomain.com, and dig TXT _dmarc.yourdomain.com. Finally, run your domain through Qualisend's domain health check to confirm the eom CNAME, all three DKIM selectors, and the DMARC record resolve cleanly and that your root SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — EmailOctopus (via Amazon SES) should appear as an aligned, fully-passing source.

Domain health check DMARC report analyzer

Common gotchas

Coverage
"Verify email address" is not domain verification. It authorises a single From address but gives you no DKIM, no SPF alignment, and no DMARC — the equivalent of a SendGrid Single Sender. You must choose Verify domain (recommended) to actually authenticate.
DNS setup
"Partially verified" almost always means the DMARC TXT is missing. People add the four CNAMEs and stop; the domain won't go fully Verified until you also publish the generated _dmarc TXT record and click Complete verification.
Breaks auth
Don't add include:amazonses.com to your ROOT SPF for native EmailOctopus. SPF is handled behind the eom mail-from subdomain, so the include is unnecessary, burns one of your 10 SPF lookups, and does nothing for DMARC alignment. The include only applies to EmailOctopus Connect / your own SES.
DNS setup
Keep the eom CNAME forever. It's your Return-Path and the source of your SPF alignment and bounce handling — deleting it later (during a DNS cleanup) silently breaks SPF and bounce processing even though DKIM still passes.
DNS setup
Cloudflare proxy breaks the CNAMEs. Set the eom record and all three DKIM selectors to "DNS only" (grey cloud); an orange-cloud proxied CNAME won't resolve to amazonses.com and verification fails.
DNS setup
Host-field doubling. Many registrars auto-append your domain, so entering eom.yourdomain.com becomes eom.yourdomain.com.yourdomain.com. Enter just the label (eom, or the token._domainkey selector) — EmailOctopus's own troubleshooting tip is to strip the .yourdomain.com if verification stalls.
Coverage
Only relaxed SPF alignment is possible. Your envelope domain is eom.yourdomain.com, not the bare root, so a DMARC record with aspf=s (strict SPF) fails SPF alignment — DKIM still carries the DMARC pass, so nothing breaks, but you needlessly lose your second passing mechanism. Leave aspf relaxed (the default); strict DKIM alignment (adkim=s) is fine.
DNS setup
Native EmailOctopus and EmailOctopus Connect are different setups. Native uses the CNAME flow above; Connect sends through your own Amazon SES account, where you enable Easy DKIM, configure a custom MAIL FROM, add include:amazonses.com to that domain's SPF, and publish DMARC yourself in AWS.

Build your SPF record

EmailOctopus doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Sending sources

Search for each platform you send email through and tick it.

Search for your email platform above, or .

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record0/10 DNS lookups

v=spf1 ~all

No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list