SPF, DKIM & DMARC for Gladly.
Gladly is a customer-service platform, not a bulk ESP — it runs your support team's email channel, sending agent replies as your own support address and pulling inbound customer messages in through forwarding. Under the hood Gladly sends every outbound reply through Mailgun, which is why authenticating your domain means publishing two DNS records that Gladly generates on its Email settings: an SPF line that contains include:mailgun.org and a DKIM public-key TXT. You add both to the DNS for your sending domain, wait up to 72 hours for Gladly to flip the domain from Unverified to Verified, then contact Gladly Support to wire up your reply-to address and configure inbound forwarding. Once verified, replies leave Gladly fully authenticated and aligned to your own domain instead of falling back to an unauthenticated envelope.
Why authenticate Gladly?
For a support platform, authentication is higher-stakes than for a marketing tool — every message is a 1:1 reply a customer is actively waiting on, so a message that lands in spam or bounces is a support failure, not just a missed open. Since February 2024, Gmail and Yahoo have required bulk senders (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing similar rules for Outlook/Hotmail high-volume senders in 2025 — and even below those thresholds the same checks are now table stakes for the inbox. Until you add and verify your Gladly domain, replies go out on an unauthenticated envelope: recipients' servers can't verify the mail is really from you, SPF and DKIM don't align to your domain, DMARC can't pass, and your support mail pools its reputation with everyone else. Verifying the domain fixes all of it at once — because Gladly (via Mailgun) uses your own domain in the SMTP envelope and signs DKIM as d=yourdomain, both SPF and DKIM align to your organizational domain, DMARC passes, and the sending reputation you build accrues to you.
The SPF reality for Gladly
Gladly is a genuine SPF include provider because it sends through Mailgun: you publish v=spf1 include:mailgun.org ~all (or merge include:mailgun.org into your existing v=spf1 line) on the single SPF record for your sending domain. Gladly generates this exact value for you on its View SPF and DKIM Values screen — unlike CNAME-delegation ESPs (SendGrid, Klaviyo, Mailchimp) there is no CNAME that satisfies SPF on your behalf; you paste the TXT yourself. The important catch is that include:mailgun.org is unusually heavy. Verified against live DNS it resolves to five nested lookups — mailgun.org publishes include:_spf.mailgun.org (which itself nests _spf1 and _spf2) plus include:_spf.eu.mailgun.org, so one line covers both the US and EU sending regions — which is half of the RFC 7208 ten-lookup budget in a single include. And because Gladly sends from your real support address (support@yourdomain.com), that heavy include normally lands on your organizational domain's SPF, right next to Google Workspace or Microsoft 365. If your root SPF is already crowded you can blow the 10-lookup limit and trigger a PermError that breaks SPF for every sender on the record. The clean mitigation is to give Gladly its own dedicated sending subdomain (for example help.yourdomain.com) so the heavy Mailgun include lives on the subdomain's own SPF and never touches your root. Whichever domain you use, keep exactly one SPF record on it — merge include:mailgun.org into the existing v=spf1 line rather than publishing a second SPF TXT (two SPF records is itself a PermError). One important nuance: by default Mailgun uses its own domain (mailgun.org) as the envelope/Return-Path, so include:mailgun.org authorizes SPF but SPF does not align to your From domain. Alignment for DMARC is instead carried by DKIM, which signs as d=yourdomain — the same model as most ESPs, so make sure DKIM verifies; it's the leg your DMARC pass relies on.
Step by step
- 1
Open Email settings in Gladly
Click the hamburger menu at the top-left, choose Settings, then under the Channels category select Email. You need the Administrator role (a Team Manager can open a support request but can't edit domains). This opens the Email Channel configuration where sending domains live.
- 2
Add your sending domain
On the Domains tab, click Add Domain (or, if you have none yet, type it into the prompt) and enter your domain in lowercase — e.g. yourdomain.com or a dedicated subdomain like help.yourdomain.com — then click Save and Continue. Enter it carefully: a saved domain can't be edited or deleted (a typo needs a Gladly Support ticket to fix), and only lowercase is accepted. Decide root vs subdomain deliberately: if your root SPF already stacks Google Workspace/Microsoft 365 plus marketing tools, use a subdomain so the heavy Mailgun include stays off your root record.
- 3
Reveal the SPF and DKIM values
Hover over the domain and click View SPF and DKIM Values (also labelled Find SPF and DKIM TXT Values). Copy the SPF line — it contains include:mailgun.org — and the DKIM TXT, which is a <selector>._domainkey host plus a k=rsa; p=… public key. These values are generated per-domain, so use exactly what Gladly shows.
- 4
Publish or merge the SPF record
At your DNS host, on the sending domain add a TXT record: host @ (or the subdomain label), value v=spf1 include:mailgun.org ~all. If a v=spf1 record already exists, don't create a second one — merge include:mailgun.org into that single line (e.g. v=spf1 include:_spf.google.com include:mailgun.org ~all). Keep exactly one SPF record per host.
- 5
Publish the DKIM TXT record
Add a TXT record at the selector host Gladly shows (a <selector>._domainkey.yourdomain.com name, e.g. smtp._domainkey) with the value k=rsa; p=<long base64 key>. Because it's a 2048-bit key it often exceeds the 255-character single-string TXT limit — split it into two quoted strings (most DNS UIs do this automatically when you paste one line). Enter only the selector portion where your host already appends the domain, and watch that your registrar doesn't append the domain twice.
- 6
Add a DMARC record (Gladly won't)
Gladly never publishes DMARC, so add your own: a TXT at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none to collect reports and confirm Gladly plus every other sender passes aligned, then tighten to p=quarantine and eventually p=reject.
- 7
Add MX records only if it's a bare subdomain
Gladly flags that an email domain with no website (no A/CNAME) — typically a subdomain — may need MX records to work with some receivers. If your sending domain is a subdomain with no site attached, add the MX records for your inbound/mail host. Skip this if the domain already resolves to a website. It does not repoint mail to Gladly.
- 8
Verify in Gladly, then set reply-to and forwarding
Return to Gladly and check back within 72 hours — the SPF and DKIM status flips from Unverified to Verified once DNS propagates (use the kebab menu's Check Verification Status to re-poll). Add the records about one week before launch so Gladly has time to test. Then contact Gladly Support to configure your reply-to address, and set up forwarding from your existing mail server to the Gladly-generated address (of the form localpart@yoursubdomain.inbound.gladly.email) so inbound customer replies reach Gladly — Gladly receives mail by forwarding, not by MX pointed at Gladly.
- 9
Test outbound alignment
Send a real reply from Gladly to an inbox you control (Gmail works well) and open Show original / full headers. Confirm dkim=pass with d=yourdomain and dmarc=pass. SPF authenticates against Mailgun's Return-Path domain (mailgun.org), so it passes but does not align — DKIM is the aligned mechanism carrying DMARC. Verified status in Gladly only proves the records parse — the header check is what proves alignment.
Records to add
Gladly generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:mailgun.org ~allSPF for your Gladly sending domain (host @ for a root domain, or the subdomain label). Gladly generates this on View SPF and DKIM Values. Merge include:mailgun.org into your existing v=spf1 line if one exists — keep one SPF record. include:mailgun.org costs ~5 DNS lookups toward the RFC 7208 limit of 10. |
| TXT | <selector>._domainkey.yourdomain.com | k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC... (per-account, truncated)DKIM — illustrative. The exact selector label (often smtp) and 2048-bit public key are unique to your domain and shown on Gladly's View SPF and DKIM Values screen. Split a 2048-bit key into two quoted strings if your DNS host requires it, and enter only the selector portion where your host auto-appends the domain. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comDMARC companion — Gladly does not create this. Start at p=none and tighten to quarantine/reject after monitoring reports. Required to meet Gmail/Yahoo/Microsoft bulk-sender rules. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Gladly's setup costs against that budget.
Gladly adds 5 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
Gladly hands you a static DKIM TXT record, not an auto-rotating CNAME: a <selector>._domainkey.yourdomain.com host (the selector is often smtp) holding k=rsa; p=<2048-bit base64 public key>. Gladly (through Mailgun) generates the key pair, keeps the private key, and shows you the public key to paste. Outbound mail is signed with d= your sending domain, so DKIM aligns relaxed to your organizational domain and carries a DMARC pass. Two operational notes matter. First, a 2048-bit public key usually exceeds the 255-character single-string TXT limit, so it must be split into two quoted strings — most DNS panels chunk it automatically when you paste one line, but a few require you to add the quotes yourself, and a malformed split means dkim=fail even though the record technically exists. Second, rotation is manual: unlike Mailgun's modern Automatic Sender Security CNAMEs, this static key doesn't rotate itself — regenerating it in Gladly means re-editing the DNS TXT, so treat key rotation as a scheduled maintenance task. Copy the selector exactly as shown; a wrong selector or a truncated key is the most common reason a \"green\" setup still fails DKIM.
DMARC
Gladly never publishes a DMARC record — you add it yourself, and you need it to satisfy the Gmail, Yahoo, and Microsoft sender rules even after SPF and DKIM verify. The key point: DKIM is what carries DMARC here. It signs as d=yourdomain and aligns, so a DMARC record passes on the DKIM leg as soon as it's live. SPF authenticates through include:mailgun.org but does not align (Mailgun's default Return-Path is mailgun.org, not your domain) — which is fine, because DMARC only needs one aligned mechanism, and DKIM provides it. Publish a TXT at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Run p=none first to collect aggregate reports and confirm Gladly and every other legitimate sender is passing aligned, then step up to p=quarantine and finally p=reject. If you run Gladly on a dedicated subdomain, remember the subdomain inherits the organizational domain's policy unless you either publish a _dmarc record on the subdomain or set an sp= subdomain policy on the parent.
Check it actually worked
After you add the records, Gladly re-checks DNS within 72 hours and flips SPF and DKIM from Unverified to Verified on the Domains screen (you can force a re-poll from the kebab menu's Check Verification Status). Don't stop there — a Verified status only confirms the records parse, not that mail aligns. Send a real reply from Gladly to an inbox you control (Gmail is easiest) and open Show original / full headers: you want dkim=pass with d=yourdomain and dmarc=pass — SPF will show spf=pass authenticated against Mailgun's Return-Path (mailgun.org), which passes but does not align, so DKIM is the leg that carries your DMARC pass. Then run your sending domain through an external SPF/DKIM/DMARC checker to confirm include:mailgun.org resolves cleanly and your total SPF lookups stay under 10 — this is the check that catches a PermError from stacking the heavy Mailgun include on an already-crowded record. Only when the header shows all three aligned is the domain genuinely production-ready.
Common gotchas
- Breaks auth
include:mailgun.org is heavy — verified live it resolves to five DNS lookups (mailgun.org nests _spf.mailgun.org, which nests _spf1/_spf2, plus _spf.eu.mailgun.org, covering both regions). That's half the RFC 7208 ten-lookup budget in one include, and because Gladly sends from your real support address it usually lands on your organizational domain's SPF. If Google Workspace/Microsoft 365 and marketing tools are already there, you can trigger a PermError. Mitigate by running Gladly on a dedicated sending subdomain.
- Breaks auth
Keep exactly one SPF record per domain. Merge include:mailgun.org into your existing v=spf1 line — don't publish a second SPF TXT, which is itself a PermError. Gladly's own example shows the merge, e.g. v=spf1 include:spf.protection.outlook.com include:mailgun.org -all.
- DNS setup
The DKIM key is a static TXT, not an auto-rotating CNAME. A 2048-bit key exceeds the 255-character TXT string limit and must be split into two quoted strings (most hosts do this automatically — verify it). Rotating the key means regenerating in Gladly and re-editing DNS by hand.
- Coverage
Add the records about one week before launch. DNS verification can take up to 72 hours, and Gladly needs lead time to test the sending domain before it goes live — the status stays Unverified until both records confirm.
- Coverage
A saved domain is permanent — it can't be edited or deleted, and only lowercase is accepted. A typo means opening a Gladly Support ticket to fix it, so double-check the domain before you click Save and Continue.
- Coverage
Outbound and inbound are two separate jobs. SPF + DKIM authenticate outbound replies; inbound customer mail reaches Gladly only after you set up forwarding from your mail server to a Gladly-generated address (localpart@yoursubdomain.inbound.gladly.email), which preserves the original From. Forwarding won't work until the domain is Verified, and Gladly does not receive mail via MX pointed at Gladly.
- Coverage
The reply-to address is not self-service — you must contact Gladly Support to configure it, then set up forwarding for that reply-to address too so replies route back into Gladly.
- DNS setup
Gladly never creates a DMARC record. Without a _dmarc TXT you can't meet the Gmail/Yahoo/Microsoft bulk-sender requirements even though SPF and DKIM pass — publish your own and start at p=none.
- DNS setup
A bare sending subdomain with no website (no A/CNAME) may need MX records to work with some receivers, which Gladly explicitly flags. Also watch registrars that auto-append your domain to the DKIM host, doubling it (…_domainkey.yourdomain.com.yourdomain.com).
Build your SPF record
Gladly is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listGladly SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.