SPF, DKIM & DMARC for Loops.

Why authenticate Loops?

Authenticating your Loops domain isn't optional housekeeping — Loops won't send as your domain until the records verify, and that verification is the authentication. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same requirements for high-volume senders in 2025. Loops runs on shared Amazon SES infrastructure and manages the underlying SES account, reputation, and sending limits for you — so, unlike raw SES, you never touch a sandbox or request production access. But the authentication that ties that mail to your domain is still yours to publish. Until you add and verify the records, mail is signed only with SES's shared amazonses.com key, nothing aligns to your From domain, DMARC fails, and your sending reputation is pooled with every other unauthenticated SES tenant. Publishing the Loops record set fixes all of it in one pass: SES signs as d=yourdomain.com so DKIM aligns, the envelope MAIL FROM aligns SPF, DMARC passes, and the reputation you build accrues to your own domain.

The SPF reality for Loops

Loops is a per-account provider, not an include provider — there is no include:loops.so, and you do NOT add include:amazonses.com to your ROOT SPF record. Loops instead sets a custom MAIL FROM on a dedicated subdomain, envelope.yourdomain.com, and publishes the SPF mechanism there: a TXT record at host envelope with the value v=spf1 include:amazonses.com ~all, plus one MX record at the same envelope host pointing to feedback-smtp.{region}.amazonses.com. Because those two records live on that dedicated envelope subdomain and never on your bare root, they add ZERO DNS lookups to your root SPF and cannot collide with an existing root SPF record — so you do not merge anything into your Google Workspace or Microsoft 365 SPF line, and you should not try to. And because envelope.yourdomain.com shares the organizational domain yourdomain.com with your visible From address, SPF aligns in relaxed mode automatically. That is the key difference from a bare Amazon SES setup: Loops wires up the custom MAIL FROM for you, so you get SPF alignment out of the box rather than SPF that passes only for amazonses.com. The one record you keep singular and at the root is DMARC.

Step by step

Records to add

Loops generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Loops's setup costs against that budget.

Check it actually worked

Don't trust the dashboard alone — confirm on a real message. In Loops, every row on the domain page should show a green verified checkmark after you click Verify Records. Then send yourself a test from your Loops domain, open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS listing envelope.yourdomain.com (not just amazonses.com), DKIM: PASS with d=yourdomain.com, and DMARC: PASS. Prefer a full report? Send a test to check-auth@verifier.port25.com and it emails back a complete breakdown. You can also run your domain through Qualisend's domain health check to confirm all three DKIM CNAMEs plus the envelope SPF/MX resolve, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Loops (via Amazon SES) should appear as an aligned, passing source.

Common gotchas

• Breaks auth

  Records don't go where you'd guess: SPF and MX live on the envelope.yourdomain.com subdomain (Loops' custom MAIL FROM), so they never touch or collide with your root SPF. Never add include:amazonses.com to your root SPF — it belongs only on the envelope subdomain, and on the root it does nothing useful while burning an SPF lookup.

• DNS setup

  Don't pre-create the envelope subdomain. You do NOT need to add an A or CNAME record for envelope first — just publish the SPF TXT and the MX at that host label and they'll resolve.

• DNS setup

  MX priority formatting trips people up. The envelope MX must be priority 10; some registrars want the priority in a separate field, others expect it inline as "10 feedback-smtp.…". Enter it the way your panel requires, and keep exactly one MX on the envelope subdomain.

• DNS setup

  Use the Type column, not the friendly title. Loops labels rows SPF / DKIM / MX, but you must create each record by its actual Type (TXT, CNAME, or MX). Creating a DKIM CNAME as a TXT, or the SPF as a CNAME, is the most common reason Verify Records fails.

• DNS setup

  Cloudflare proxy breaks DKIM. Set all three DKIM CNAMEs to "DNS only" (grey cloud); an orange-cloud proxied CNAME won't resolve to *.dkim.amazonses.com and the record stays unverified.

• Breaks auth

  Keep a single DMARC at the root. Loops lists a DMARC entry so you have one, but two DMARC records on the same domain is invalid — if you already have _dmarc.yourdomain.com from another sender, keep it and skip Loops' copy.

• Coverage

  Values are per-account — copy them, don't guess. The DKIM tokens and the feedback-smtp region in the MX (e.g. us-east-1) are specific to your Loops domain; paste the exact strings from View records rather than reusing another domain's or another guide's.

• Breaks auth

  Watch for host-doubling and trailing dots. Enter just the label (envelope, token1._domainkey) if your panel auto-appends the domain, and where a host wants an FQDN for the CNAME/MX value use a trailing dot so feedback-smtp.us-east-1.amazonses.com isn't mangled into …amazonses.com.yourdomain.com.

Build your SPF record

Loops doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Loops SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.