Do I need to add include:spf.migadu.com to my SPF record?

Yes. Unlike CNAME-only ESPs, Migadu is a genuine include provider and sends with your own domain in the envelope sender, so this include both authorizes Migadu's sending IPs and lets SPF align for DMARC. The full record is v=spf1 include:spf.migadu.com -all. If you already have an SPF record, merge the include into it rather than adding a second one.

Why does the DKIM CNAME point to a target that contains my own domain?

That's how Migadu delegates DKIM per domain. Your record key1._domainkey.yourdomain.com is a CNAME to key1.yourdomain.com._domainkey.migadu.com, a name inside Migadu's zone where the actual public key is published. It lets Migadu hold the private key and rotate it without you ever editing DNS. The target is correct exactly as shown.

Why are there three DKIM records (key1, key2, key3)?

Multiple selectors let Migadu rotate signing keys with zero downtime — it can retire one selector and switch to another while both remain valid. Add all three CNAMEs; Migadu decides which key is actively signing your mail.

How many of my 10 SPF lookups does Migadu use?

Four. include:spf.migadu.com is not a flat record — it nests include:smtp.migadu.com, include:rel.migadu.com, and include:mx.migadu.com, so it costs one lookup for the top-level include plus three for the nested ones. That's heavier than Google Workspace or Microsoft 365 (one each), so watch the 10-lookup limit if you combine senders.

Do I still need DKIM if Migadu's SPF already aligns?

Yes — set up both. SPF alignment breaks the moment a message is forwarded through a mailing list or .forward rule, and at that point aligned DKIM is the only thing carrying your DMARC pass. Migadu's three DKIM CNAMEs sign as d=yourdomain.com, which is what keeps DMARC passing in the real world.

Should I use v=spf1 mx -all instead of the include?

No — prefer include:spf.migadu.com. Some older Migadu write-ups suggest v=spf1 mx -all, which only authorizes the IPs your MX (aspmx1/aspmx2.migadu.com) resolve to. Those overlap with part of Migadu's sending infrastructure but not all of it — Migadu also sends from the smtp.migadu.com and rel.migadu.com ranges that the mx mechanism never covers. include:spf.migadu.com pulls in all three sending sources (smtp, rel, mx), which is exactly what Migadu publishes on its own domain, so it's the complete and future-proof choice.

My mail isn't sending or receiving — what did I miss?

Almost always domain verification. Confirm the hosted-email-verify TXT resolves on your root, both MX records (aspmx1 and aspmx2.migadu.com) point to Migadu with the old host's MX removed, and the admin panel shows the domain active. Migadu only activates a domain after those checks pass, which can take up to 24–48 hours to propagate.

SPF setup guide

SPF, DKIM & DMARC for Migadu.

Q: Does Migadu create my DMARC record?

No — you publish _dmarc yourself, starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com in your own DNS zone. Migadu suggests a DMARC record in the admin panel but never writes it for you, and it isn't required for the domain to activate — only the ownership TXT and MX are. Add it as one TXT record at _dmarc.yourdomain.com, hold it at p=none until your aggregate reports confirm Migadu is passing SPF and DKIM aligned, then tighten to p=quarantine and eventually p=reject.

Migadu is a full mailbox host — it sends and receives mail for your domain over IMAP/POP/SMTP — not a transactional ESP, so "authenticating your domain" here means publishing the DNS records Migadu shows when you add a domain in its admin panel. That set is real DNS at your own registrar: an ownership-verification TXT record, two MX records (aspmx1/aspmx2.migadu.com) so Migadu can receive your mail, a genuine shared SPF include (include:spf.migadu.com), three CNAME-delegated DKIM selectors (key1/key2/key3._domainkey) that let Migadu rotate signing keys for you, and a DMARC policy you publish yourself. Because Migadu puts your own domain in the envelope sender, SPF actually aligns — so a correctly set-up Migadu domain passes DMARC on both SPF and DKIM, the resilient configuration that survives forwarding.

SPF include

Your DNSAdd the CNAME / TXT records

MigaduSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Migadu?

Authenticating a Migadu domain decides whether your mail reaches the inbox, and it also gates whether Migadu will send and receive for the domain at all. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025. Migadu sends over shared IP infrastructure, so the sending reputation you build depends on your mail being cleanly attributable to your own domain. Migadu is unusually well-behaved here: it uses your domain as the SMTP MAIL FROM (envelope/Return-Path), so SPF aligns to your organizational domain and contributes a DMARC pass on its own — something Return-Path-owning ESPs like Mailchimp can't do. But SPF alignment breaks the instant a message is forwarded through a mailing list or .forward rule, so the CNAME-delegated DKIM is what keeps DMARC passing in the real world. Skip it and a forwarded message has no aligned authentication left. And until the ownership TXT and MX records resolve, Migadu won't activate the domain, so mail simply won't flow.

The SPF reality for Migadu

Migadu is a true "include" provider: you add one shared mechanism, include:spf.migadu.com, to the single SPF TXT record on your root domain, giving v=spf1 include:spf.migadu.com -all — which is exactly what Migadu publishes on its own domain. This is a real shared include every Migadu customer uses, not CNAME delegation. It pulls real DMARC weight because Migadu sends with your own domain in the envelope sender / Return-Path — you own the domain, Migadu processes the bounces to it — so SPF aligns to your organizational domain rather than resolving against a provider-owned bounce domain. Migadu recommends the -all (hard fail) qualifier, and its own domain publishes -all. The genuinely Migadu-specific catch is cost: include:spf.migadu.com is NOT a cheap one-lookup include like Google's _spf.google.com or Microsoft's spf.protection.outlook.com. It nests three sub-includes — include:smtp.migadu.com (the submission servers), include:rel.migadu.com (the outbound relays), and include:mx.migadu.com (the mail exchangers) — so it consumes FOUR of your 10 SPF DNS lookups under RFC 7208, not one. If you also stack Google Workspace, Microsoft 365, or a newsletter tool in the same SPF record, that budget disappears fast and can tip you into a PermError. Keep exactly one SPF TXT record on the domain and merge every sender's mechanism into it — never publish a second v=spf1 record, which is itself a PermError.

Step by step

In Migadu

1
Add your domain in the admin panel
Sign in at admin.migadu.com and open Domains, then add yourdomain.com. Migadu generates the exact DNS records for that domain — the ownership TXT, MX, SPF, three DKIM CNAMEs, and suggested DMARC — and shows them on the domain's page. Leave this tab open; you'll copy from it.

In your DNS

2
Add the ownership-verification TXT
At your DNS host, add a TXT record on the root (host @ or blank) with the value Migadu shows, in the form hosted-email-verify=xxxxxxxxxxxx. Migadu uses this to confirm you control the domain before it activates mail. Leave it in place — Migadu keeps re-checking it, so don't delete it once the domain is verified.
3
Point MX at Migadu
Add two MX records on the root: aspmx1.migadu.com at priority 10 and aspmx2.migadu.com at priority 20. Delete any MX records from a previous host so inbound mail routes only to Migadu. MX is about receiving, not authentication, but a half-migrated MX is the single most common reason Migadu mail doesn't work.
4
Publish or merge the SPF record
Add a TXT record on the root with v=spf1 include:spf.migadu.com -all. If a v=spf1 record already exists (Google Workspace, a newsletter tool, etc.), merge include:spf.migadu.com into that single record — never add a second SPF TXT. Remember this include costs four DNS lookups, so mind the 10-lookup limit if you stack senders.
5
Add the three DKIM CNAMEs
Create three CNAME records: host key1._domainkey pointing to key1.yourdomain.com._domainkey.migadu.com, key2._domainkey to key2.yourdomain.com._domainkey.migadu.com, and key3._domainkey to key3.yourdomain.com._domainkey.migadu.com. The target embedding your own domain is correct, not a typo. Keep the type as CNAME — don't switch to TXT and don't paste a key.
6
Publish the DMARC record
Migadu doesn't create DMARC for you. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so nothing about delivery changes while you confirm both SPF and DKIM align. Keep exactly one _dmarc record per domain.
7
(Optional) Add client autoconfig records
To let Thunderbird, Apple Mail, and Outlook auto-detect settings, add a CNAME autoconfig pointing to autoconfig.migadu.com and the SRV records Migadu lists — _submissions._tcp (port 465, smtp.migadu.com), _imaps._tcp (993, imap.migadu.com), and _pop3s._tcp (995, pop.migadu.com). These are convenience records for mail clients, not authentication — skip them if you configure clients by hand.

In Migadu

8
Wait for the domain to activate
Migadu re-checks your DNS on a schedule; the domain usually flips to verified/active within about 30 minutes, though full DNS propagation can take up to 24–48 hours. You can't send or receive until the panel shows the domain active with the ownership TXT and MX detected.

Verify

9
Send a test and read the headers
From a mailbox on the domain, email yourself at Gmail, open the message and choose ⋮ → Show original. Confirm SPF: PASS showing your domain, DKIM: PASS with d=yourdomain.com (selector key1, key2, or key3), and DMARC: PASS. Then run the domain through a health check to confirm every record resolves.

Records to add

Migadu generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	@	hosted-email-verify=xxxxxxxxxxxxxxxxDomain-ownership verification — illustrative; copy the exact string from admin.migadu.com. Leave it in place; Migadu keeps re-checking it.
MX	@	aspmx1.migadu.comInbound mail, priority 10. Required to receive — remove any old host's MX.
MX	@	aspmx2.migadu.comInbound mail, priority 20 (backup exchanger).
TXT	@	v=spf1 include:spf.migadu.com -allRoot SPF — keep exactly one SPF record; merge other senders into this line. This include costs 4 DNS lookups (it nests smtp/rel/mx).
CNAME	key1._domainkey	key1.yourdomain.com._domainkey.migadu.comDKIM selector 1 — CNAME-delegated; Migadu holds and rotates the key. The target contains your own domain by design.
CNAME	key2._domainkey	key2.yourdomain.com._domainkey.migadu.comDKIM selector 2 — pair to key1; lets Migadu rotate keys with no downtime.
CNAME	key3._domainkey	key3.yourdomain.com._domainkey.migadu.comDKIM selector 3 — add all three exactly as shown.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Migadu never creates it. One per domain; start at p=none, then tighten.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Migadu's setup costs against that budget.

SPF 10-lookup budget4 used · 6 free

Migadu adds 4 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

Migadu handles DKIM through CNAME delegation, so there is no key to generate or paste. Migadu publishes three selectors for your domain — key1, key2, and key3 — and you add three CNAME records: key1._domainkey.yourdomain.com pointing to key1.yourdomain.com._domainkey.migadu.com, and the same pattern for key2 and key3. The target hostname embedding your own domain (keyN.yourdomain.com._domainkey.migadu.com) looks odd but is exactly right: that name lives in Migadu's zone and resolves to a TXT record containing the actual public key (v=DKIM1; k=rsa; p=…). Because these are CNAMEs rather than TXT records you copy, Migadu holds the private keys and can rotate the published public keys behind the three selectors without you ever editing DNS again — which is why there are three selectors: Migadu can retire one and roll to another with zero downtime. Migadu signs your outbound mail with d=yourdomain.com, so DKIM aligns with your From domain and carries a DMARC pass even when SPF breaks on forwarding. Add all three CNAMEs exactly as shown; if your DNS is behind Cloudflare, set each to DNS only (grey cloud), because an orange-cloud proxied CNAME won't resolve to migadu.com and DKIM will fail.

DMARC

DMARC is a separate policy record you publish yourself — Migadu suggests one but doesn't create it in your zone, and it isn't required for the domain to activate (only the ownership TXT and MX are). Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to email you aggregate (rua) reports so you can confirm Migadu mail is passing SPF and DKIM aligned to your domain. Migadu is one of the providers where this ramps up cleanly and fast — because it aligns SPF (your own envelope domain) and DKIM (the keyN selectors on your domain), you get dual-aligned passes, the setup that keeps passing even when a message is forwarded. Watch the reports for a week or two, make sure every legitimate sender is authenticating, then tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain no matter how many senders you use; subdomains inherit the parent policy unless you override them. For reference, Migadu's own domain runs p=quarantine — a reasonable enforcement target once you've confirmed alignment.

Check it actually worked

Don't trust the admin panel's status badge alone — confirm it on a real message. Send yourself a test from a mailbox on the domain, open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS showing yourdomain.com, DKIM: PASS with d=yourdomain.com and a key1/key2/key3 selector (not a migadu.com signature), and DMARC: PASS. You can spot-check the raw records from a terminal with dig TXT yourdomain.com (SPF), dig CNAME key1._domainkey.yourdomain.com (should resolve to key1.yourdomain.com._domainkey.migadu.com and on to a DKIM1 key), and dig TXT _dmarc.yourdomain.com. In the Migadu admin panel the domain should show as verified/active with MX and SPF detected. Finally, run the domain through Qualisend's domain health check to confirm the SPF, all three DKIM selectors, MX, and DMARC resolve cleanly and the SPF stays under the 10-lookup limit — and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer to confirm Migadu shows up as an aligned, passing source.

Domain health check DMARC report analyzer

Common gotchas

Breaks auth
Migadu's SPF is heavy: include:spf.migadu.com costs FOUR DNS lookups because it nests smtp.migadu.com, rel.migadu.com, and mx.migadu.com — not one lookup like Google or Microsoft. Stacking other senders in the same record can blow the RFC 7208 10-lookup limit and cause a PermError, so budget carefully.
DNS setup
Migadu won't send or receive for the domain until the ownership TXT (hosted-email-verify=…) resolves and the domain shows active in the panel. Don't delete that TXT after setup — Migadu keeps re-checking it, and removing it can deactivate the domain.
Coverage
Both MX records are required and must be Migadu's: aspmx1.migadu.com (priority 10) and aspmx2.migadu.com (priority 20). Leaving an old host's MX in place splits your inbound mail and is the most common 'my Migadu email isn't working' cause.
DNS setup
The DKIM CNAME target legitimately contains your own domain — key1.yourdomain.com._domainkey.migadu.com is correct, not a typo or a doubled host. Keep the record type as CNAME; never convert it to TXT or paste a DKIM public key.
DNS setup
Cloudflare proxy breaks CNAME DKIM: set key1/key2/key3._domainkey to DNS only (grey cloud). An orange-cloud proxied CNAME won't resolve to migadu.com and DKIM validation fails.
DNS setup
Host-field doubling: registrars that auto-append your domain turn key1._domainkey into key1._domainkey.yourdomain.com.yourdomain.com. Enter just the label (key1._domainkey) when the panel adds the domain for you.
Breaks auth
Keep exactly one SPF TXT record on the root. If you also send via Google Workspace, Microsoft 365, or a marketing tool, merge include:spf.migadu.com into that single v=spf1 line — two SPF records is itself a PermError.
Coverage
Use ~all while migrating and only switch to -all once every legitimate sender is listed. Migadu recommends -all (hard fail) and uses it on its own domain, but a premature -all hard-fails any mail source you forgot to add.

Build your SPF record

Migadu is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Migaduinclude:spf.migadu.comGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:spf.migadu.com ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list