SPF, DKIM & DMARC for MailerSend.
MailerSend authenticates your sending domain with a small, fixed set of DNS records you copy from its dashboard: a root SPF TXT record that includes _spf.mailersend.net, a CNAME-delegated DKIM key, and a custom Return-Path CNAME on an mta subdomain. Unlike pure CNAME providers, MailerSend genuinely wants the SPF include on your root domain — but the Return-Path CNAME is the piece that makes SPF align for DMARC. Add all three (plus your own DMARC record) and MailerSend can send as your domain with SPF, DKIM, and DMARC all passing and aligned.
Why authenticate MailerSend?
Authenticating your domain in MailerSend is what decides whether your transactional and marketing mail reaches the inbox. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began rejecting non-compliant mail in 2025. Until you verify a domain, MailerSend won't let you send from it at all — and even the trial sandbox only sends to your own verified test recipients. Once the SPF include, DKIM CNAME, and Return-Path CNAME are live, both SPF (via your mta subdomain) and DKIM (via the mlsend selector) align to your organizational domain, DMARC passes, and the sending reputation you build accrues to your domain rather than a shared pool. For anyone running password resets, receipts, or campaigns through MailerSend, this is the difference between the inbox and the spam folder.
The SPF reality for MailerSend
MailerSend is a genuine include-style provider: you add a shared SPF include to your root domain, v=spf1 include:_spf.mailersend.net ~all. Today that include flattens to a single record (v=spf1 ip4:212.11.79.0/24 ~all), so it costs exactly one of your 10 SPF DNS lookups — no nested includes to worry about. But the part that actually makes DMARC's SPF check pass with alignment is the custom Return-Path CNAME: MailerSend sets the envelope MAIL FROM to mta.yourdomain.com, so SPF is evaluated against that subdomain, which CNAMEs into MailerSend's own SPF-authorized space and — being a subdomain of your domain — aligns with your From: address under relaxed alignment. In short, the root include authorizes MailerSend on your organizational domain, and the mta Return-Path CNAME is what makes SPF align for DMARC. Publish both. If you skip the Return-Path CNAME, MailerSend falls back to its own bounce domain, SPF stops aligning to yours, and DMARC can fail its SPF check even though the raw SPF still passes on mailersend.net (DKIM alignment can still carry DMARC, but you've thrown away one of your two alignment legs).
Step by step
- 1
Add your sending domain in MailerSend
In the MailerSend dashboard, open Email > Domains and click Add domain. Enter the domain (or, better, a sending subdomain — see below). MailerSend immediately generates the exact SPF, DKIM, and Return-Path values for that domain and shows a per-provider DNS setup screen. Leave this page open; you'll copy from it.
- 2
Prefer a sending subdomain
MailerSend supports and recommends sending from a subdomain such as mail.yourdomain.com or news.yourdomain.com. A subdomain isolates your MailerSend sending reputation from your primary mailbox domain (Google Workspace / Microsoft 365) and keeps each sending stream's DNS clean. If you use a subdomain, every record below is published relative to that subdomain in your DNS.
- 3
Publish the SPF TXT record on your root (or sending) domain
Add a TXT record at @ (or your sending subdomain) with the value MailerSend shows: v=spf1 include:_spf.mailersend.net ~all. If you already send from that domain through another provider, do NOT create a second SPF record — merge include:_spf.mailersend.net into your one existing v=spf1 line and keep a single ~all at the end.
- 4
Add the DKIM CNAME
Under CNAME records, add the DKIM record exactly as MailerSend gives it: host like mlsend2._domainkey pointing to mlsend2._domainkey.mailersend.net. This is a CNAME, not a TXT public key — the key itself lives on MailerSend's side. Copy the host and target verbatim; don't retype the selector.
- 5
Add the Return-Path CNAME
Add a CNAME with host mta pointing to mailersend.net. This sets your custom Return-Path (bounce/envelope domain) to mta.yourdomain.com, which is what lets SPF align to your domain for DMARC and routes bounce and feedback events back through MailerSend.
- 6
(Optional) Add tracking and inbound records
If you enable a custom tracking domain in MailerSend, add the CNAME it shows — host email pointing to links.mailersend.net — so open/click links use your domain instead of mailersend.net. If you plan to receive replies via inbound routing, add the MX record MailerSend provides (host like inbound, value inbound.mailersend.net, priority 10). Both are optional; skip them if you're not using those features.
- 7
Publish your DMARC record
MailerSend doesn't create DMARC for you. Add a TXT record at _dmarc pointing to v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start at p=none to collect reports, then tighten to quarantine and reject once you confirm MailerSend mail is passing aligned.
- 8
Verify the domain in MailerSend
Back on the domain's DNS page, tick 'I have added DNS records' and click Verify domain (older UI: Finish verification). Records usually resolve within minutes, but propagation can take up to 48 hours. MailerSend re-checks SPF, DKIM, and Return-Path and marks each green when it resolves.
- 9
Confirm on a real message and get approved to send
Send a test to a Gmail address, open Show original, and confirm SPF: PASS, DKIM: PASS, DMARC: PASS with the signing and Return-Path domains on yours. Remember that DNS verification is necessary but not sufficient — new MailerSend accounts must also be manually approved before you can send outside your test recipients, so submit the approval request if prompted.
Records to add
MailerSend generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.mailersend.net ~allIllustrative. Keep exactly one SPF record per domain — if you already have a v=spf1 line, merge include:_spf.mailersend.net into it rather than adding a second record. On a sending subdomain, publish this at the subdomain instead of @. |
| CNAME | mlsend2._domainkey | mlsend2._domainkey.mailersend.netIllustrative selector — MailerSend assigns mlsend or mlsend2 per domain. Copy the exact host and target from your Domains page. DKIM is CNAME-delegated, so there is no TXT public key to paste. |
| CNAME | mta | mailersend.netCustom Return-Path. Sets the envelope MAIL FROM to mta.yourdomain.com so SPF aligns for DMARC and bounces route back to MailerSend. Don't skip it. |
| CNAME | links.mailersend.netOptional — only add this if you enable a custom tracking domain in MailerSend, so open/click links use your domain. The subdomain (email) is configurable. | |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou publish this yourself. One DMARC record per domain. Start at p=none, then move to quarantine and reject once reports look clean. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what MailerSend's setup costs against that budget.
MailerSend adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
MailerSend delegates DKIM with a CNAME rather than a pasted TXT public key. The record host looks like mlsend2._domainkey.yourdomain.com and points to mlsend2._domainkey.mailersend.net; the actual RSA public key lives on MailerSend's side, so when they rotate keys you never have to touch DNS again. Copy the exact selector — MailerSend assigns mlsend or mlsend2 depending on the domain — and the exact target from the Domains page; don't retype or guess it. Because it's a CNAME, the usual 255-character TXT-splitting problems never apply, but two host-panel quirks do. First, some DNS editors auto-append your domain to a CNAME target, producing the broken value mlsend2._domainkey.mailersend.net.yourdomain.com — enter the target with a trailing dot, or exactly as your host expects, so it resolves to MailerSend. Second, if your DNS is proxied through Cloudflare, set this CNAME to DNS only (grey cloud); a proxied DKIM CNAME resolves to Cloudflare's edge instead of MailerSend's key and DKIM will never verify.
DMARC
DMARC is a separate policy record you publish yourself — MailerSend doesn't create it during verification, though its dashboard offers DMARC monitoring on paid plans (and 30 days free on Starter). Add a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to send you aggregate reports so you can confirm MailerSend mail is passing SPF and DKIM aligned to your domain. Because MailerSend aligns both mechanisms (SPF via your mta Return-Path subdomain, DKIM via the mlsend selector on your domain), you should see clean passes quickly. Watch the rua reports for a week or two, make sure every legitimate sender — MailerSend plus any other tools on the domain — is authenticating, then tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole domain regardless of how many senders you use. Gmail and Yahoo's bulk-sender rules require at least p=none, but p=reject is what actually stops spoofing.
Check it actually worked
Don't trust the green badge alone — MailerSend can lag DNS and still say 'up to 48 hours' after records are live. Confirm on a real message: send a test from your MailerSend domain to a Gmail address, open it, and choose Show original. You want SPF: PASS, DKIM: PASS, and DMARC: PASS, with the DKIM signing domain and the Return-Path (mailed-by / SPF) domain both showing yourdomain.com rather than mailersend.net. From the command line: dig TXT yourdomain.com (SPF include present), dig CNAME mlsend2._domainkey.yourdomain.com (resolves to mlsend2._domainkey.mailersend.net), dig CNAME mta.yourdomain.com (resolves to mailersend.net), and dig TXT _dmarc.yourdomain.com. Then run the domain through Qualisend's domain health check to confirm every record resolves and SPF stays under the 10-lookup limit, and once your first DMARC aggregate report arrives, drop it into the DMARC report analyzer — MailerSend should appear as a fully aligned, passing source. Remember: verifying DNS lets MailerSend send as your domain, but a trial account still needs manual approval before it can send to anyone beyond your test recipients.
Common gotchas
- Breaks auth
Keep exactly one SPF TXT record on the domain. If you already send through Google Workspace, Microsoft 365, or another ESP, merge include:_spf.mailersend.net into that single v=spf1 line — two separate SPF records is a PermError and breaks SPF entirely.
- DNS setup
Don't skip the Return-Path CNAME (mta → mailersend.net). It sets the envelope domain to mta.yourdomain.com, which is what makes SPF align to your domain for DMARC. Without it, SPF still 'passes' on mailersend.net but no longer aligns, so DMARC can fail its SPF side.
- DNS setup
DKIM is a CNAME, not a TXT public key. If your DNS panel only shows a TXT field for '_domainkey' records, you're on the wrong record type — use a CNAME pointing to mlsend2._domainkey.mailersend.net and copy the selector exactly (mlsend vs mlsend2 is assigned per domain).
- DNS setup
Some DNS editors auto-append your domain to CNAME targets, producing broken values like mlsend2._domainkey.mailersend.net.yourdomain.com or mailersend.net.yourdomain.com. Enter targets with a trailing dot, or exactly as your host expects, so they resolve to MailerSend.
- DNS setup
If your DNS is proxied through Cloudflare, set the DKIM, Return-Path, and any tracking CNAME to 'DNS only' (grey cloud). Proxied (orange cloud) CNAMEs resolve to Cloudflare's edge instead of MailerSend and will fail verification.
- Coverage
Verifying DNS is not the same as being allowed to send. New MailerSend accounts sit in a trial that only reaches your own verified test recipients until MailerSend manually approves the account — submit the approval request separately.
- DNS setup
Only add the tracking CNAME (email → links.mailersend.net) if you actually enable a custom tracking domain, and only add the inbound MX if you use inbound routing. Adding records for features you don't use just clutters DNS.
- Coverage
Each sending domain or subdomain needs its own SPF, DKIM, and Return-Path records. Authenticating yourdomain.com does not cover mail.yourdomain.com — verify the exact domain you send from in MailerSend.
Build your SPF record
MailerSend is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listMailerSend SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.