SPF, DKIM & DMARC for Moosend.
Moosend authenticates your sending domain from its Senders page, not a one-click wizard. You add (or pick) a sender email, open Set up SPF, DKIM, and Moosend hands you two TXT records to publish — one SPF (include:spfa.mailendo.com) and one DKIM (at the ms._domainkey selector) — plus a DMARC step. You publish them at your DNS host, click Verify DNS records, and green checkmarks confirm Moosend can send campaigns as your own domain instead of a shared Moosend address. There is a genuine shared SPF include here, but DKIM is the record that actually earns your DMARC pass.
Why authenticate Moosend?
Authenticating a Moosend domain is the difference between the inbox and the spam folder, and as a marketing ESP you are almost certainly the kind of sender the rules were written for. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail/Live in 2025 — and a Moosend newsletter blast is exactly that kind of bulk send. Until you authenticate, Moosend sends under its own infrastructure (its sending platform runs on the mailendo.com domain): recipients can see the mail isn't cryptographically from you, your From address doesn't align, DMARC can't pass, and your sending reputation is pooled with every other unauthenticated Moosend sender. Publishing the SPF include and the ms._domainkey DKIM key fixes all of it — DKIM signs as your own domain, DMARC passes on alignment, and the reputation you build accrues to your domain rather than the shared pool.
The SPF reality for Moosend
Moosend is a true "include" provider: include:spfa.mailendo.com is a genuine shared mechanism (mailendo.com is Moosend's own sending infrastructure) that you merge into the single SPF TXT record on your root domain — the record Moosend hands you is v=spf1 include:spfa.mailendo.com ~all. Verified against live DNS: spfa.mailendo.com resolves to a flat record containing only ip4: ranges and its own ~all, with no nested includes, so it costs exactly ONE of your 10 SPF DNS lookups — not the two or three some older guides assume. There's an alignment nuance worth understanding, though. Like most marketing ESPs, Moosend processes bounces on its own return-path (mailendo.com), so the SPF check often runs against Moosend's envelope domain rather than your From domain. That means the include can produce a raw SPF pass without actually ALIGNING to your organizational domain for DMARC — which is precisely why the DKIM record (the ms._domainkey TXT) matters just as much: DKIM signed as d=yourdomain.com is the mechanism that reliably carries your DMARC pass. Still publish the SPF include — it's part of Moosend's required two-record setup and Moosend's verifier checks that it resolves — but treat DKIM as the record doing the DMARC work. And keep exactly one SPF record on your domain: merge include:spfa.mailendo.com into your existing v=spf1 line rather than adding a second SPF TXT, because two SPF records is itself a PermError.
Step by step
- 1
Open the Senders page
On the top menu bar click More → Settings, then in the left-hand menu click Senders. This one page handles both adding sender addresses and authenticating their domains — SPF, DKIM, and DMARC are all reached from here.
- 2
Add or select the sender email
If the From address you'll send campaigns from isn't listed, click Add new and save it (e.g. news@yourdomain.com). Moosend authenticates per sender/domain, so the address you'll actually send from needs to exist here before you set up DNS.
- 3
Open Set up SPF, DKIM
Click Set up SPF, DKIM (shown as Set up DNS on some accounts) next to your sender. Moosend displays two TXT records — one for SPF and one for DKIM — each with a Name/Host and a Value, plus a DMARC step. Leave this screen open; you'll copy from it.
- 4
Copy the DKIM value carefully
Click the DKIM record to reveal it. The host is ms._domainkey and the value Moosend shows often begins at k=rsa; p=<long public key>. Copy the whole p= key as one unbroken string, then prepend v=DKIM1; so the published value reads v=DKIM1; k=rsa; p=… — the RFC-recommended form. A key that gets truncated or split across lines is the most common reason a DKIM record won't validate.
- 5
Publish or merge the SPF record
At your DNS host add a TXT record on the root (host @ or blank) with v=spf1 include:spfa.mailendo.com ~all. If an SPF record already exists (Google Workspace, Microsoft 365, another tool), don't create a second one — merge include:spfa.mailendo.com into that single v=spf1 line. spfa.mailendo.com (mailendo is Moosend's sending infra) is correct, not a typo.
- 6
Publish the DKIM TXT record
Add a TXT record with host ms._domainkey and value v=DKIM1; k=rsa; p=<the key Moosend gave you>. Keep the type as TXT — Moosend's DKIM is a static key, not a delegated CNAME. For a subdomain sender the host is ms._domainkey.subdomain.
- 7
Add the DMARC record
Moosend surfaces a DMARC step but doesn't create the record for you. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so nothing about delivery changes while you confirm alignment. Skip this if you already have a _dmarc record — a domain must have exactly one.
- 8
Verify in Moosend
Back on the Senders page, click Verify DNS records. Green checkmarks appear next to SPF and DKIM once they resolve. Propagation is usually 30 minutes but can take up to 48 hours; if a check doesn't catch immediately, wait and re-run it.
- 9
Confirm on a real message
Send a test to a Gmail address, open it, and choose ⋮ → Show original. You want SPF: PASS, DKIM: PASS with d=yourdomain.com (selector ms), and DMARC: PASS — the DKIM domain showing yourdomain.com is your aligned pass, not the Moosend/mailendo host.
Records to add
Moosend generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:spfa.mailendo.com ~allRoot SPF — keep exactly ONE SPF record; merge include:spfa.mailendo.com into your existing v=spf1 line if you already have one. Costs 1 of your 10 DNS lookups (verified flat ip4-only record). |
| TXT | ms._domainkey | v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…(public key from Moosend)Illustrative — copy the exact key from Set up SPF, DKIM in your Moosend account. Moosend usually shows the value starting at k=rsa; p=…; prepend v=DKIM1; for the RFC-recommended form and paste the full p= key without added spaces or line breaks. TXT, not CNAME. Subdomain senders use ms._domainkey.subdomain. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Moosend never creates it. One per domain; start at p=none, then tighten to quarantine/reject. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Moosend's setup costs against that budget.
Moosend adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM in Moosend is a static TXT record you publish at the ms._domainkey selector — host ms._domainkey.yourdomain.com — not a CNAME delegated to Moosend. When you open Set up SPF, DKIM on the Senders page, Moosend shows the record's name and a value that typically begins at k=rsa; p=<long public key>. Two Moosend-specific details trip people up. First, publish the value with a v=DKIM1; tag at the front, so the final record reads v=DKIM1; k=rsa; p=<key>. Omitting v= is technically valid — RFC 6376 treats a missing version as the default DKIM1, and Gmail, Yahoo, and Microsoft will still pass the signature — but prepending v=DKIM1; is the RFC-recommended form and keeps stricter validators and some DNS panels from flagging the record. If a key you copied exactly still won't validate, the more common culprit is the long p= value itself: a DNS panel that truncated it or inserted a space or line break breaks the key, so paste it as one unbroken string. Second, because this is a TXT key you paste (not a CNAME Moosend controls), Moosend holds the matching private key but there is no automatic key rotation — if you ever rotate the key you re-copy the new value into DNS yourself. Once the record resolves, Moosend signs your outgoing campaigns with d=yourdomain.com, so DKIM aligns to your domain and carries your DMARC pass. If your From address uses a subdomain, the host becomes ms._domainkey.subdomain.yourdomain.com, and that subdomain needs its own SPF too.
DMARC
DMARC is a separate policy record you publish yourself — Moosend shows a DMARC step in the Set up SPF, DKIM screen, but it doesn't create the record for you. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but asks receivers to email you aggregate (rua) reports so you can confirm that Moosend mail is passing DKIM aligned to your domain (and SPF where it aligns). Watch those reports for a week or two, make sure every legitimate sender — Moosend plus any other tools — is authenticating, then tighten the policy to p=quarantine and eventually p=reject once alignment is consistent. Keep exactly one _dmarc record for the whole domain no matter how many senders you use; Moosend itself notes you can skip its DMARC step if you already have a DMARC record in place, since a domain can have only one. Because Moosend's return-path means SPF may not align, DMARC here leans on aligned DKIM — which is another reason the ms._domainkey record isn't optional.
Check it actually worked
Verifying Moosend happens on two layers. In Moosend: after publishing, return to the Senders page and click Verify DNS records — green checkmarks next to SPF and DKIM mean the records resolve. Propagation is usually 30 minutes but can take up to 48 hours, and Moosend lets you re-run the check if it doesn't catch immediately. But the dashboard checkmarks only confirm the records exist, not that mail aligns, so confirm on a real message: send a test campaign or test email to a Gmail address, open it, and choose ⋮ → Show original. You want SPF: PASS, DKIM: PASS with d=yourdomain.com and selector ms (not the mailendo host), and DMARC: PASS. Then run your domain through Qualisend's domain health check to confirm the SPF, the ms._domainkey DKIM record, and your DMARC record all resolve cleanly and your SPF stays under the 10-lookup limit, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Moosend/mailendo should appear as an aligned, passing source. One Moosend quirk to know: editing that domain's DNS after verification can drop its senders back to unverified, and Moosend re-checks verified senders periodically — so if a sender flips to unverified, just click Verify DNS records again.
Common gotchas
- DNS setup
Publish the DKIM value with a v=DKIM1; tag. Moosend often displays the key starting at k=rsa; p=… with no version tag — publish it as v=DKIM1; k=rsa; p=… . Omitting v= is technically valid (RFC 6376 defaults it to DKIM1, and Gmail/Yahoo/Microsoft pass it), but the tag is the recommended form and avoids warnings from stricter validators. Just as important: paste the long p= key as one unbroken string — a truncated or space-broken key is the most common reason a Moosend DKIM record fails to validate.
- Coverage
spfa.mailendo.com is correct, not a typo. Moosend's sending platform runs on the mailendo.com domain, so the include really is include:spfa.mailendo.com — don't 'fix' it to a moosend.com host.
- Coverage
SPF may pass without aligning. Moosend owns the return-path/bounce domain, so the include can produce a raw SPF pass that doesn't align to your From domain for DMARC. DKIM (ms._domainkey) is what carries the aligned pass — never skip it.
- Breaks auth
Keep exactly ONE SPF TXT record. If you already send via Google Workspace, Microsoft 365, another ESP, etc., merge include:spfa.mailendo.com into that single v=spf1 line — two SPF records is a PermError.
- DNS setup
Both Moosend records are TXT, not CNAME. There's no CNAME to delegate and no automatic key rotation — Moosend's DKIM is a static key you paste, so if you ever rotate it you re-copy the new value yourself.
- Coverage
Editing DNS after verification can un-verify a domain's senders. After any DNS change, go back to the Senders page and click Verify DNS records again; Moosend also re-checks verified senders periodically.
- Coverage
Add and select the sender email first. Moosend authenticates per sender/domain on the Senders page — there's no account-wide switch, so the From address you'll actually send from must exist there before the DNS setup screen appears.
- Coverage
Subdomain senders need their own records. If your From address uses a subdomain, the DKIM host is ms._domainkey.subdomain and that subdomain needs its own SPF — your root domain's SPF record does not cover it.
Build your SPF record
Moosend is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listMoosend SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.