Do I need to add include:spf.mailjet.com to my SPF record?

Not for Mailjet's mail to authenticate. Mailjet uses its own Return-Path (bnc3.mailjet.com), so SPF is checked against Mailjet's bounce domain and your published include never applies to Mailjet messages — the mailjet._domainkey DKIM record is what aligns and passes DMARC. Add the include only if you want it for completeness, and if you do, merge it into your single root SPF record rather than publishing a second one.

Why does SPF fail, or show mailjet.com instead of my domain?

That's expected on the default shared Return-Path. Mailjet owns the envelope/bounce domain (bnc3.mailjet.com), so SPF authenticates for mailjet.com, not you — it 'passes' but doesn't align to your From domain. DMARC still passes because DKIM signs as your domain. To make SPF align you'd set up a personalized Return-Path (a bnc3 CNAME plus a Mailjet support ticket), which is a paid-plan feature.

Is Mailjet DKIM a CNAME or a TXT record?

A TXT record on the mailjet._domainkey selector holding your public key (v=DKIM1; k=rsa; p=…). Unlike SendGrid or Brevo it isn't a delegated CNAME, so Mailjet can't rotate the key for you — if you regenerate it you republish the TXT value yourself.

Should I use a 1024-bit or 2048-bit DKIM key?

2048-bit. Mailjet auto-creates 2048-bit keys for domains added since 25 April 2024 (and supports 4096-bit); older domains may still have a 1024-bit key you can upgrade by regenerating (available once the whole domain is validated). 2048-bit values are long enough that some DNS panels split them across multiple quoted strings — publish it exactly as shown.

My DKIM 'Regenerate Key' button is greyed out — why?

Because only an email address on the domain is validated, not the whole domain. Add and validate the sending domain itself under Senders & Domains, and the DKIM key generation/regeneration option unlocks.

Will Mailjet's records conflict with Google Workspace, Microsoft 365, or another sender?

No. Mailjet signs with its own mailjet._domainkey selector, so it never collides with Google's or Microsoft's DKIM selectors — each provider gets its own key. DMARC is a single domain-wide policy that covers them all at once. The only record that must stay unified is SPF (exactly one v=spf1), but since Mailjet doesn't need its include to authenticate, you usually won't touch your root SPF for Mailjet at all — leave it for Google Workspace/Microsoft 365, which do put your domain in the envelope.

Is SPF alignment (a personalized Return-Path) available on the free plan?

No — Mailjet's custom Return-Path is a paid-plan feature. You add a bounce-subdomain CNAME (bnc3.yourdomain.com → bnc3.mailjet.com) and open a support ticket with the API key tied to the domain to have it activated; you get one custom Return-Path per API key. On the free plan, or if you skip it, you rely on DKIM for DMARC alignment — which is enough to pass.

SPF setup guide

SPF, DKIM & DMARC for Mailjet.

Mailjet (now part of Sinch) authenticates your sending domain from its Senders & Domains area, and the record that actually earns you a DMARC pass is DKIM, not SPF. When you add and validate a domain, Mailjet generates a DKIM TXT record on the mailjet._domainkey selector holding your public key, and shows an SPF line (v=spf1 include:spf.mailjet.com ?all). The catch that shapes the whole setup: by default Mailjet handles bounces on its own Return-Path domain (bnc3.mailjet.com), so that SPF include is checked against Mailjet's infrastructure and never aligns to your From domain — it's the DKIM signature (d=yourdomain.com) that carries DMARC. Publish the mailjet._domainkey record, add a DMARC policy, and mail that used to be attributed to Mailjet's shared infrastructure authenticates as your own domain instead.

SPF include

Your DNSAdd the CNAME / TXT records

MailjetSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Mailjet?

Authenticating your Mailjet domain isn't housekeeping — it decides whether your mail reaches the inbox. Since 1 February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025. Until you authenticate, Mailjet sends on shared infrastructure signed as mailjet.com — recipients see the mail isn't cryptographically yours, your From address doesn't align, DMARC can't pass, and your reputation is pooled with every other unauthenticated Mailjet sender. There's a Mailjet-specific twist that makes DKIM non-negotiable: because Mailjet keeps its own Return-Path (bounce) domain, SPF never aligns to your domain by default — DKIM is the only mechanism that can carry your DMARC pass. Skip the mailjet._domainkey record and you have no aligned authentication at all. Set it up (Mailjet auto-creates 2048-bit keys for domains added since April 2024) and the signing reputation you build accrues to your own domain.

The SPF reality for Mailjet

Mailjet is listed as an "include" provider, and spf.mailjet.com is a real, live, flat SPF record — a single list of ip4 ranges ending in ~all, so it costs just one DNS lookup, not the two-or-three older guides claim. But here's the Mailjet-specific reality that makes that include close to a no-op: SPF is always evaluated against the envelope sender / Return-Path, and by default Mailjet uses its OWN bounce domain (bnc3.mailjet.com) as the Return-Path, not your domain. So when a receiver runs SPF on a Mailjet message it checks Mailjet's bounce-domain SPF — the include:spf.mailjet.com you publish on your root domain is never consulted for that message, and even when SPF "passes" it passes for mailjet.com, not for you, so it does not align and contributes nothing to DMARC. That's exactly why Mailjet's guidance is DKIM-first and why several guides tell you not to bother publishing the include at all. DKIM signed as d=yourdomain.com (the mailjet._domainkey TXT) is the mechanism that aligns and carries your DMARC pass. The one way to make SPF actually align is a personalized Return-Path: point a bounce subdomain (e.g. bnc3.yourdomain.com) at bnc3.mailjet.com with a CNAME and open a Mailjet support ticket — including the API key tied to the domain — to activate it. It's a paid-plan feature, not a self-serve toggle, and you get one custom Return-Path per API key. Practical takeaway: reserve your single root SPF record for the senders that really put your domain in the envelope (Google Workspace, Microsoft 365, a transactional relay), rely on DKIM for Mailjet, and don't count on include:spf.mailjet.com to move your DMARC result.

Two ways to set it up

Recommended

DKIM signing — mailjet._domainkey (what aligns)

One TXT record on the mailjet._domainkey selector, generated per domain inside Mailjet
Signs as d=yourdomain.com, so it aligns under relaxed DKIM and carries your DMARC pass on its own
New domains (since 25 April 2024) get 2048-bit keys (4096 is also supported); older domains have 1024-bit you can upgrade
Adds nothing to your SPF lookup budget — it's a DKIM record, not an SPF mechanism

Legacy

SPF include — include:spf.mailjet.com (passes, doesn't align)

A real, flat, 1-lookup include, but checked against Mailjet's bnc3.mailjet.com bounce domain, not yours
Never aligns to your From domain on the default (shared) Return-Path, so it doesn't help DMARC
Optional for pure-Mailjet DMARC; only worth adding if you also authorize other senders in the same record
True SPF alignment needs a personalized Return-Path — a bnc3 CNAME plus a Mailjet support ticket, on a paid plan

Step by step

In Mailjet

1
Open Senders & Domains
Log in at app.mailjet.com, open the account menu (top-right), and go to Senders & Domains → Domains (older UI: Account Settings → Domains & Sender addresses). This is where you add and validate the domain your From address uses.
2
Add and validate the whole domain
Click 'Add a Sender Domain' and enter yourdomain.com (the organizational domain, not a single address). Validate ownership when prompted — Mailjet either emails a validation link or has you publish a validation TXT record. Validate the DOMAIN, not just one address: DKIM key generation only unlocks once the whole domain is validated.
3
Open SPF/DKIM Authentication
Next to the domain, click Manage / the gear (⚙️) icon, then 'Setup SPF/DKIM Authentication'. Mailjet displays the DKIM TXT record for the mailjet._domainkey selector and the SPF line for the domain.
4
Copy the DKIM record
Copy the DKIM host (mailjet._domainkey) and its full value (v=DKIM1; k=rsa; p=<long public key>). This is the record that matters for DMARC — copy the entire key, not a truncated version.

In your DNS

5
Publish the DKIM TXT
At your DNS host add a TXT record: host mailjet._domainkey, value exactly as Mailjet shows it. A 2048-bit key is longer than the 255-character single-string TXT limit, so many panels store it as several quoted chunks in one record — paste it exactly, or let the panel reassemble the split value. Don't add line breaks or drop the quoting.
6
Leave your root SPF for aligning senders (include optional)
You do NOT need include:spf.mailjet.com for Mailjet mail to authenticate — DKIM does that, and the include won't align because Mailjet owns the Return-Path. If you want it anyway, or your root SPF already lists other senders, keep exactly ONE v=spf1 record and merge include:spf.mailjet.com into it (never publish a second SPF record). Terminate with your own ~all or -all rather than Mailjet's example ?all.
7
Publish the DMARC record
Mailjet doesn't create DMARC. Add a TXT record at host _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only so nothing is affected while you confirm Mailjet's DKIM aligns. Keep exactly one _dmarc record for the whole domain.

In your DNS + Mailjet support

8
(Optional) Set up a personalized Return-Path for SPF alignment
Only if you specifically want SPF to align too, and you're on a paid plan: add a bounce-subdomain CNAME (e.g. bnc3.yourdomain.com → bnc3.mailjet.com) and open a ticket asking Mailjet support to activate a personalized Return-Path — include the API key tied to the domain. It isn't exposed as a self-serve setting in the dashboard, and you get one custom Return-Path per API key.

Verify

9
Confirm in Mailjet and on a real message
Back on the SPF/DKIM Authentication page, click 'Force a check' (Force Refresh) and the checks turn green once records resolve (usually minutes, up to 24–48 hours). Then send a test from an address on the domain, open it in Gmail → ⋮ → Show original, and confirm DKIM: PASS with d=yourdomain.com and DMARC: PASS. SPF will typically show a bnc3.mailjet.com bounce domain rather than yours — that's expected on the default Return-Path.

Records to add

Mailjet generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	mailjet._domainkey	v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…(public key from Mailjet)The record that aligns for DMARC. Generated per domain — new domains get a 2048-bit key (since 25 Apr 2024), older ones 1024-bit; 4096 is also supported. Illustrative; copy the exact value from Mailjet's SPF/DKIM Authentication screen.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Mailjet never creates it. One per domain; start at p=none, then tighten to quarantine/reject. DKIM carries the alignment.
TXT	@	v=spf1 include:spf.mailjet.com ~allOptional — spf.mailjet.com is a flat 1-lookup include, but it's checked against Mailjet's bnc3 Return-Path, not yours, so it doesn't align. Merge into your single root SPF only if you want it; use your own ~all/-all (Mailjet's dashboard example ends in ?all).
CNAME	bnc3	bnc3.mailjet.comOptional personalized Return-Path for SPF alignment — a paid-plan feature that requires a Mailjet support ticket (with the domain's API key) to activate; not exposed in the self-serve UI. Illustrative host/target.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Mailjet's setup costs against that budget.

SPF 10-lookup budget1 used · 9 free

Mailjet adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

Mailjet DKIM is a single TXT record on the mailjet._domainkey selector — and, importantly, it's a TXT you paste, not a delegated CNAME. That means (unlike SendGrid, Brevo, or Microsoft 365) there's no delegation and no automatic key rotation: Mailjet shows you a public key (v=DKIM1; k=rsa; p=…) and you publish it in DNS, and if you ever regenerate the key you must republish the new value by hand. Since 25 April 2024 Mailjet generates 2048-bit keys for newly added domains (it also supports 4096-bit); older domains kept 1024-bit — regenerate to upgrade. A 2048-bit key is longer than a single 255-character TXT string, so many DNS panels store it as several quoted chunks inside one record; keep it on one logical record and don't introduce stray line breaks. Two Mailjet quirks to know: the DKIM key can only be generated or regenerated when the ENTIRE domain is validated — if you only validated a single sender address, the 'Regenerate Key' button is greyed out and unavailable; and because the signature is d=yourdomain.com, this DKIM record is the mechanism that aligns and carries your DMARC pass, since SPF can't given Mailjet's Return-Path. Publish the mailjet._domainkey TXT exactly as shown, wait for it to resolve, hit Force a check, and Mailjet flips the DKIM check to green.

DMARC

DMARC is a separate policy TXT record on your domain that Mailjet does not create — you add it at your DNS host. Publish it at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery while you watch the aggregate (rua) reports to confirm Mailjet mail is passing. Because Mailjet aligns via DKIM and not SPF, you're specifically looking in those reports for your own domain passing on the DKIM result. Since DKIM is the only mechanism carrying DMARC for Mailjet mail (SPF won't align on the default Return-Path), make sure the mailjet._domainkey record is verified and passing before you move past p=none — otherwise an enforcing policy could catch your Mailjet mail. Once alignment is consistent, tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain no matter how many senders you use; never add a second one just for Mailjet.

Check it actually worked

Don't trust the dashboard checkmarks alone — confirm it on a real message. Send a test from an address on the authenticated domain, open it in Gmail and choose ⋮ → Show original: you want DKIM: PASS with d=yourdomain.com and DMARC: PASS. SPF will typically show a bnc3.mailjet.com bounce/Return-Path domain rather than yours — that's expected on the default shared Return-Path and is fine, because DKIM carries the alignment (SPF only shows your domain if you've set up a personalized Return-Path). In Mailjet, use 'Force a check' on the SPF/DKIM Authentication page; it should show green checks and a DMARC-compliant indicator. Then run your domain through Qualisend's domain health check to confirm the mailjet._domainkey DKIM record and your DMARC record resolve cleanly, and once aggregate reports start arriving, drop one into the DMARC report analyzer — Mailjet should appear as an aligned, DKIM-passing source.

Domain health check DMARC report analyzer

Common gotchas

Breaks auth
SPF is essentially a no-op for Mailjet: the include is evaluated against Mailjet's own Return-Path domain (bnc3.mailjet.com), not yours, so publishing include:spf.mailjet.com on your root domain does nothing for Mailjet's DMARC result. DKIM is what aligns — don't waste time debugging SPF alignment.
DNS setup
DKIM is a TXT record you paste, not a delegated CNAME, so there is NO automatic key rotation. If you regenerate the DKIM key in Mailjet you must republish the new value in your DNS yourself.
Coverage
The Generate/Regenerate DKIM key button is greyed out unless the ENTIRE domain is validated. Validating just one sender address (you@yourdomain.com) isn't enough — validate the domain itself to unlock DKIM.
Breaks auth
2048-bit keys (default for domains added since 25 Apr 2024) exceed the 255-character TXT string limit, so they're stored as multiple quoted chunks. If Mailjet or Gmail reports the key invalid, a mangled split, a stray line break, or missing quotes in your DNS panel is the usual cause.
Breaks auth
Keep exactly ONE SPF TXT record. If you do add include:spf.mailjet.com — or already send via Google Workspace, Microsoft 365, etc. — merge everything into a single v=spf1 record; two SPF records is itself a PermError. And swap Mailjet's example ?all for your own ~all or -all.
DNS setup
SPF alignment isn't self-serve and isn't free: the only way to make SPF align is a personalized Return-Path — a bounce CNAME (bnc3.yourdomain.com → bnc3.mailjet.com) plus a Mailjet support ticket (with the domain's API key) to activate it, on a paid plan. There is no toggle for it in the UI.
Coverage
Verifying a single sender address is not domain authentication — it lets you send but doesn't give you the DKIM key or domain-level alignment, and mail still shows Mailjet attribution. Add and validate the whole domain.
Coverage
Mailjet doesn't create your DMARC record, but Gmail and Yahoo require one for bulk senders — add at least p=none yourself, and keep just one _dmarc record for the domain.

Build your SPF record

Mailjet is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Mailjetinclude:spf.mailjet.comGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:spf.mailjet.com ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list