SPF, DKIM & DMARC for Wix.

Why authenticate Wix?

Authenticating your Wix sending domain is what decides whether campaigns reach the inbox at all. Since February 2024, Gmail and Yahoo require every sender to pass SPF or DKIM with a valid, aligned From address, and any bulk sender (roughly 5,000+ messages a day to Gmail/Yahoo consumer addresses) must additionally pass DKIM and publish a DMARC policy — Microsoft began enforcing similar rules for high-volume senders in 2025. Until you authenticate, Wix sends your campaigns on its own shared domain from a pooled IP: recipients see mail that isn't aligned to you, DMARC can't pass, and your reputation is mixed in with every other unauthenticated Wix sender. Wix itself states in its deliverability guidance that, as of February 2024, business-email users "must set up SPF," and DKIM plus DMARC once you cross the bulk threshold. Completing domain authentication moves that reputation onto your own domain, makes DKIM align to your From address, and clears the Gmail/Yahoo/Microsoft gate in one pass.

The SPF reality for Wix

Wix is a CNAME-based authentication provider, so for Wix Email Marketing there is NO "include:" mechanism to add to your root SPF — nothing "Wix" goes into your v=spf1 line at all. When you authenticate the domain, Wix hands you a Return-Path/mail CNAME (its "CNAME 3") that points a sending subdomain into its SendGrid backend. Because that subdomain resolves into SendGrid's own SPF-authorized space, SPF is satisfied there automatically, and DMARC passes via relaxed SPF alignment (the Return-Path subdomain shares your organizational domain with the From address) — you never publish a Wix SPF include on your root domain. The only time a shared SPF include enters the picture on a Wix domain is if you ALSO run a Wix mailbox: Wix Business Email is powered by Google Workspace, so that path uses include:_spf.google.com — a Google include, not a Wix one. And Wix's automated site emails (order confirmations, form notifications, automation triggers) send from Wix's own domain on shared infrastructure; those can't be SPF-aligned to your domain, so authenticating your marketing domain does not retroactively cover them. Bottom line: Email Marketing = CNAME delegation with zero root-SPF changes; a Wix mailbox = Google Workspace records; automated site mail = Wix's own domain, outside your control.

Step by step

Records to add

Wix generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Wix's setup costs against that budget.

Check it actually worked

Confirm authentication in two places, not one. First, the Wix screen: after DNS propagates (a few hours, up to 24-48), refresh the Domain status under Sender Details until it reads 'Authenticated' — that means Wix found all its CNAMEs. Second, and more important, verify real alignment: send a test campaign to a Gmail address, open the message, choose 'Show original,' and check that SPF = PASS, DKIM = PASS, and that the DKIM d= domain and the Return-Path both show your domain (aligned) rather than a bare sendgrid.net address. Then run your domain through an external SPF/DKIM/DMARC checker to confirm the records resolve publicly and your _dmarc is the self-managed TXT, not an accidental Wix CNAME. Green in Wix plus PASS-and-aligned in the headers is the real finish line.

Common gotchas

• DNS setup

  Wix's auto-DMARC (CNAME 5) is a trap: it publishes a policy with no rua address, so you get compliance-on-paper and zero visibility. Skip it and publish your own _dmarc TXT with a reporting mailbox instead.

• DNS setup

  Never put both a CNAME and a TXT at _dmarc. If you added Wix's DMARC CNAME 5 and also want your own policy, delete the CNAME first — DNS forbids a CNAME beside any other record at the same name, so the collision breaks DMARC lookups entirely.

• Breaks auth

  Email Marketing and your Wix mailbox are different products. Authenticating campaigns (SendGrid CNAMEs) does nothing for your mailbox, which is Google Workspace and needs Google's MX, SPF include (include:_spf.google.com), and DKIM — and vice versa.

• Coverage

  Automated site emails (order confirmations, form/contact notifications, automations) send from Wix's own domain on shared infrastructure and can't be aligned to yours. Don't expect domain authentication to fix their From address or DMARC alignment.

• Coverage

  Enter only the Host prefix, not the full domain. Wix shows the whole hostname but most DNS panels append your domain automatically — pasting the full FQDN creates a broken record like s1._domainkey.yourdomain.com.yourdomain.com.

• DNS setup

  Check whether your domain is connected to Wix (Wix nameservers) or just pointed to another registrar. If it's pointed, add the CNAMEs at that registrar — records added inside Wix are ignored when Wix isn't your authoritative DNS host.

• DNS setup

  These are CNAMEs, not TXT records. Don't try to 'read' a DKIM public key out of them or paste them into an SPF include — there is no Wix SPF include, and the keys are delegated, not published by you.

• DNS setup

  A bare Wix auto-DMARC is not enough once you cross the bulk threshold (~5,000 messages/day to Gmail/Yahoo). The requirement is a working, monitored DMARC policy with DKIM alignment — self-manage the _dmarc TXT so you can actually see the reports and tighten the policy.

Build your SPF record

Wix doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

Wix SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.