SPF, DKIM & DMARC for Scaleway Transactional Email.
Scaleway Transactional Email (TEM) authenticates your sending domain from the console's DNS records tab, and unlike CNAME-delegation providers it is a genuine "include" provider: you paste its shared SPF include, a console-generated DKIM TXT key, and a DMARC policy into your own DNS zone, then let the console verify them. TEM also offers an optional blackhole MX record and, if your domain is registered with Scaleway Domains and DNS, one-click autoconfiguration that writes all four records (SPF, DKIM, DMARC, MX) for you. Until the domain verifies — Scaleway requires both SPF and DKIM before it will accept mail — TEM will not let you send at all, so this is the very first thing to get right.
Why authenticate Scaleway Transactional Email?
Authenticating your domain in TEM decides whether your mail is even accepted, not just where it lands. Scaleway sends transactional mail from shared French IP ranges (its SPF include currently lists 62.210.3.0/24, 51.159.124.109 and 51.159.124.110, plus 2001:bc8 IPv6 blocks), and until you publish SPF and DKIM for your own domain that mail is only weakly attributable to you: your From address isn't cryptographically yours, DMARC can't pass, and your reputation is pooled with every other unauthenticated sender on that infrastructure. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began rejecting non-compliant mail to Outlook.com in 2025. Because TEM has you place the SPF include and the DKIM selector on your own domain, both SPF and DKIM align to you once configured, DMARC passes, and the per-domain reputation score TEM tracks accrues to your domain instead of to the shared pool.
The SPF reality for Scaleway Transactional Email
Scaleway TEM is a real "include" provider: you add one shared mechanism, include:_spf.tem.scaleway.com, to the single SPF TXT record on your sending domain. If the domain has no SPF record yet, the console tells you to publish the full record v=spf1 include:_spf.tem.scaleway.com -all; if you already have an SPF record, you merge just the include:_spf.tem.scaleway.com fragment into your existing v=spf1 line rather than publishing a second record (two SPF records is a PermError). Two Scaleway-specific details matter. First, the include is cheap: _spf.tem.scaleway.com resolves to a single flat record containing only ip4:/ip6: ranges with no nested includes, so it costs exactly one of your 10 allowed SPF DNS lookups (RFC 7208) — not the three or four that stacked-include providers cost. Second, Scaleway's own instructions end the record with the strict -all (hardfail), which is unusual — most providers suggest ~all. That is fine if TEM is your only sender, but if you also send through Google Workspace, Microsoft 365, Mailchimp, etc., a -all will hard-fail all of them unless every source is listed in that one SPF record; add them first, or keep ~all until every sender is merged in. Note the leading underscore (it is _spf.tem.scaleway.com, not spf.tem.scaleway.com), and always copy the exact include string shown in your console's DNS records tab.
Two ways to set it up
Autoconfiguration (domain at Scaleway Domains & DNS)
- When adding a Scaleway domain, tick "Configure my Transactional Email DNS records automatically" before clicking Validate domain name
- Scaleway writes SPF, DKIM, DMARC and MX into your DNS zone for you (you can also enable this later from the DNS Verification tab)
- No copy-pasting record names or values, and no host-field doubling mistakes
- Fastest path to a validated domain; you focus on sending and watching the reputation score
Manual DNS (external / third-party registrar)
- You copy each record from the console's DNS records tab into your DNS host yourself
- SPF: v=spf1 include:_spf.tem.scaleway.com -all (or merge the include into your existing record)
- DKIM: paste the console-generated Name (selector) and v=DKIM1 value as a TXT record
- Ownership validation can take longer; Scaleway then re-checks the records periodically
Step by step
- 1
Open Transactional Email
Log in at console.scaleway.com and click Transactional Email in the Domains & Web Hosting section of the side menu. The Transactional Email overview page displays.
- 2
Select a plan and add your domain
Click Select a plan and choose Essential (pay-as-you-go, one webhook per domain) or Scale (fixed price, includes 100K emails, a dedicated IPv4+IPv6, unlimited webhooks, and a 30-day commitment for IP warm-up). Then click Choose a plan and add a domain.
- 3
Pick a Scaleway or external domain
Choose Use a Scaleway domain or Add a domain external to Scaleway. For a Scaleway domain you can also tick Add a domain prefix to send from a subdomain (e.g. mail.yourdomain.com); all records then live in that subdomain's zone.
- 4
(Scaleway domain) Autoconfigure the records
If the domain is registered with Scaleway Domains and DNS, tick "Configure my Transactional Email DNS records automatically" before clicking Validate domain name — Scaleway writes SPF, DKIM, DMARC and MX for you. (You can also enable/disable this later from the domain's DNS Verification tab.) Then skip the manual DNS steps and go to verification.
- 5
(External domain) Open the DNS records tab
Click the domain name, then open the DNS records tab. Scroll to the SPF, DKIM and DMARC records section — this is where the console displays the exact Name/Value for each record to copy.
- 6
Add or merge the SPF record
On the root of your sending domain, add a TXT record. No existing SPF: v=spf1 include:_spf.tem.scaleway.com -all. Already have SPF: merge include:_spf.tem.scaleway.com into your existing v=spf1 line — never publish a second SPF record.
- 7
Add the DKIM TXT record
Add a TXT record in the same zone. Copy the Name shown in the console (a unique selector ending in ._domainkey) into the Name field, and the value (v=DKIM1; k=rsa; p=…) into the Value field, exactly as displayed. Do not invent the selector.
- 8
Publish the DMARC record
Add a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The v and p tags are mandatory and tags are separated by semicolons. p=none is monitor-only, so nothing is blocked while you confirm alignment.
- 9
(Optional) Add Scaleway's blackhole MX
Only if your domain has NO inbound mail server: add an MX record on the root with priority 10 and hostname blackhole.tem.scaleway.com. (keep the trailing dot). This is a blackhole — anything sent back to it is discarded. If you already receive mail on the domain, keep your own MX and skip this.
- 10
Let the console verify the records
Back in the domain, watch the DNS records / DNS Verification tab. Scaleway checks the records automatically and re-checks periodically; propagation and validation can take up to 48 hours, so keep every record in place.
- 11
Send a test and read the headers
Once the domain shows verified, send from an address on the authenticated domain, open it in Gmail, and choose ⋮ → Show original. Confirm SPF: PASS, DKIM: PASS (signed-by yourdomain.com), and DMARC: PASS, all aligned to your domain.
Records to add
Scaleway Transactional Email generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.tem.scaleway.com -allRoot SPF. Keep exactly one SPF record — if you already have one, merge just include:_spf.tem.scaleway.com into it. Scaleway's instructions use strict -all; use ~all while other senders are still being added. |
| TXT | <selector>._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…IDAQABIllustrative. The selector (Name) is a unique string Scaleway generates per domain — copy the exact Name and Value from the console's DNS records tab; do not guess the selector. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou publish this yourself. v and p are mandatory, tags semicolon-separated. Start at p=none, then tighten to quarantine/reject once TEM is passing aligned. |
| MX | @ | blackhole.tem.scaleway.com.Optional, priority 10. A blackhole that discards anything returned to it — add it only if the domain has no real inbound MX. Keep the trailing dot. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Scaleway Transactional Email's setup costs against that budget.
Scaleway Transactional Email adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM for Scaleway TEM is a static TXT record you copy from the console, not a delegated CNAME. In the domain's DNS records tab, Scaleway displays a DKIM record whose Name is a unique selector it generated for your domain (a random-looking label ending in ._domainkey) and whose Value is a standard public key of the form v=DKIM1; k=rsa; p=<your public key>. You paste both, verbatim, into a TXT record in the same zone as the sending domain (or the prefixed subdomain, if you configured one); Scaleway keeps the matching private key and signs your outgoing mail through its relay (smtp.tem.scaleway.com). Two things make this different from CNAME-based providers. First, because you paste a TXT value rather than delegate a CNAME, there is no automatic key rotation on a manually configured domain — if Scaleway ever rotates the key you must re-copy the new value, and the domain can drop to invalid on Scaleway's periodic re-check if the record no longer matches (autoconfigured Scaleway-DNS domains are updated for you). Second, an RSA DKIM public key is long enough to exceed the 255-character limit for a single TXT string, so many DNS panels store it as several quoted chunks inside one record; most reassemble it correctly, but if verification reports the key as invalid, a mangled concatenation is the usual cause. The selector is not a fixed word like "scw" that you can type from memory — copy the exact Name and Value as shown.
DMARC
DMARC is a separate policy record you publish yourself — Scaleway shows a suggested value but does not create it unless you use autoconfiguration. Add a TXT record whose Name is _dmarc followed by your domain (e.g. _dmarc.yourdomain.com) with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Scaleway's docs require the v and p tags at minimum and that tags are separated by semicolons; p=none is monitor-only, so it changes nothing about delivery while you confirm that TEM mail passes SPF and DKIM aligned to your domain. Watch the aggregate (rua) reports for a week or two, make sure every legitimate sender is authenticating, then tighten to p=quarantine and finally p=reject for real anti-spoofing protection — note that under p=reject, any mail from a source not in your SPF record or missing a valid DKIM signature is rejected outright, so confirm every sender is listed first. One Scaleway-specific nuance: you can run more than one DMARC record for a domain as long as each has a different Name, so if you send from a prefixed subdomain (e.g. tem.yourdomain.com) you can publish _dmarc.tem.yourdomain.com alongside _dmarc.yourdomain.com. Never publish two DMARC records at the same name.
Check it actually worked
Don't rely on the console badge alone — verification can take up to 48 hours and Scaleway re-checks periodically, so the DNS records / DNS Verification tab is the source of truth for whether SPF, DKIM, DMARC and MX each resolve. Once the domain shows verified, confirm it on a real message: send from an address on the authenticated domain, open it in Gmail, and choose ⋮ → Show original. You want SPF: PASS, DKIM: PASS with signed-by: yourdomain.com (your unique selector), and DMARC: PASS — all aligned to your domain rather than to scaleway.com. You can spot-check the raw records with dig TXT _spf.tem.scaleway.com (you should see one flat ip4/ip6 record, confirming the single-lookup cost), dig TXT <selector>._domainkey.yourdomain.com, and dig TXT _dmarc.yourdomain.com. Finally, run the domain through Qualisend's domain health check to confirm every record resolves and your SPF stays within the 10-lookup limit, use the SPF/DKIM/DMARC checker to validate the three records together, and once aggregate reports start arriving, drop one into the DMARC report analyzer — Scaleway should appear as an aligned, passing source.
Common gotchas
- DNS setup
Scaleway's default new-domain SPF ends in -all (strict hardfail), not the usual ~all. If you also send through Google Workspace, Microsoft 365, Mailchimp, or any other tool, -all will hard-fail all of them unless every source is in that one SPF record. Add every sender first, or keep ~all until you're certain the list is complete.
- Coverage
Note the leading underscore: the mechanism is include:_spf.tem.scaleway.com, not spf.tem.scaleway.com. Always copy the exact string the console's DNS records tab displays.
- Coverage
Older Scaleway tutorials (and a still-live legacy alias) reference include:_spf.scw-tem.cloud instead of _spf.tem.scaleway.com. Both resolve to the same flat ip4/ip6 record today, but copy the exact include your console shows now — don't paste one from a cached blog post.
- Breaks auth
Keep exactly one SPF TXT record on the domain. If you already have SPF, merge only the include:_spf.tem.scaleway.com fragment into it — publishing a second v=spf1 record is a PermError that breaks SPF entirely.
- DNS setup
The DKIM Name is a unique, console-generated selector ending in ._domainkey — not a fixed word you can type from memory. Copy the Name and Value verbatim, and watch for host-field doubling where a registrar appends your domain to the ._domainkey name.
- Coverage
The blackhole MX (blackhole.tem.scaleway.com.) discards everything returned to it with no recovery. Add it only if the domain has no real inbound mail server — if you receive mail on the domain, keep your existing MX and skip Scaleway's. And keep the trailing dot, or the registrar appends your domain to the hostname.
- Coverage
Verification can take up to 48 hours and Scaleway performs periodic re-checks. If a record is later changed, truncated, or removed, the domain can flip back to invalid and sending stops — treat these records as permanent.
- Coverage
Autoconfiguration only works when the domain is registered with Scaleway Domains and DNS. External domains must be configured manually, and ownership validation may take longer.
- DNS setup
Long RSA DKIM keys exceed the 255-character single-string TXT limit and are stored as split quoted chunks. If verification reports the key invalid, a broken concatenation by your DNS panel is the most likely cause.
Build your SPF record
Scaleway Transactional Email is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listScaleway Transactional Email SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.