SPF, DKIM & DMARC for Yandex 360.
Yandex 360 for Business (the mailbox suite formerly known as Yandex.Mail for Domain / Yandex Connect) doesn't authenticate your domain with a one-click wizard — it splits the job across the admin console and your DNS host. SPF is a genuine shared mechanism you add to your root record (include:_spf.yandex.net, or the redirect= shortcut Yandex documents), DKIM is a single TXT record under the mail selector whose key you generate in Domains → Add DKIM, and DMARC is a third record Yandex recommends but never creates for you. Because Yandex 360 is a real mailbox host — it puts your own domain in the envelope sender when you send through its SMTP — both SPF and DKIM align to your domain once configured, so a properly set-up Yandex domain can pass DMARC on either mechanism.
Why authenticate Yandex 360?
Authenticating a Yandex 360 domain is what decides whether your mail reaches the inbox, and it matters twice over here because Yandex is a major mailbox provider as well as your sender. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began rejecting non-compliant high-volume mail to Outlook.com/Hotmail/Live in 2025 — so mail from your Yandex domain is graded against all three. Yandex itself is stricter than most inbound receivers: it wants outbound messages DKIM-signed and enforces SPF/DKIM/DMARC aggressively on the way in, so any mail you send to yandex.ru, yandex.com, or a Yandex 360 tenant is checked hard. Until you authenticate, Yandex sends your mail only weakly attributable to your domain: your From address isn't cryptographically yours, DMARC can't pass, and your sending reputation doesn't accrue to your own name. Setting up SPF, DKIM, and DMARC aligns both mechanisms to your domain, lets DMARC pass, and — because aligned DKIM survives forwarding where SPF doesn't — keeps you authenticated even when messages are relayed through mailing lists or .forward rules.
The SPF reality for Yandex 360
Yandex 360 is a true "include" provider — you add one shared mechanism to the single SPF TXT record on your root domain, and (unlike Return-Path-owning ESPs such as Mailchimp) SPF actually ALIGNS here because Yandex uses your own domain as the SMTP envelope sender when you send through its servers. Yandex documents two forms. The mergeable form is v=spf1 include:_spf.yandex.net ~all — use this if you send from anything besides Yandex, because the include sits inside your own record alongside other senders (add ip4: mechanisms for any extra sending servers). The shortcut form is v=spf1 redirect=_spf.yandex.net, which is the ENTIRE record — it hands SPF evaluation to Yandex and only works if Yandex is your one and only sender for the domain. Yandex recommends the ~all (softfail) qualifier, not -all, because domains on Yandex frequently also send legitimately through other tools. The critical accuracy point most guides get wrong: include:_spf.yandex.net is NOT a single flat lookup. It redirects internally — _spf.yandex.net → redirect=_spf.yandex.ru → include:_spf-ipv6.yandex.ru + include:_spf-ipv4-yc.yandex.ru — so it consumes about FOUR of your 10 SPF DNS lookups (RFC 7208), not the one that most articles and cached checkers claim. That's a real constraint when you stack Yandex with Google Workspace, a marketing tool, or a relay. And there must be exactly one SPF TXT record on the domain: merge every sender's mechanism into a single v=spf1 line rather than publishing a second SPF record (two SPF records is a PermError).
Two ways to set it up
include:_spf.yandex.net — mergeable (recommended)
- Sits inside your own v=spf1 … ~all record, so you can add Google Workspace, SendGrid, a relay, or an ip4: server alongside it
- You keep control of the final qualifier — Yandex recommends ~all (softfail), which you can only set on your own record
- The only workable option the moment you send from anything besides Yandex
- Costs about 4 of your 10 SPF lookups because of Yandex's internal redirect chain — watch the limit when stacking senders
redirect=_spf.yandex.net — Yandex-only shortcut
- v=spf1 redirect=_spf.yandex.net is the ENTIRE record — it delegates SPF evaluation wholesale to Yandex
- Simplest choice if Yandex is your one and only sender for the domain
- You can't add other senders or your own ip4: mechanisms — a redirect record has no room for them
- You inherit whatever qualifier Yandex publishes; add anything alongside it and SPF breaks
Step by step
- 1
Add and confirm your domain
Sign in at admin.yandex.com as the organization admin and open the Domains page. Click Add domain, enter yourdomain.com, and confirm ownership using one of Yandex's methods — the usual choice is a DNS record (a yandex-verification TXT, or a CNAME), but an HTML file or a meta tag on your site also work. The domain must show as confirmed before mail or DKIM will work.
- 2
Add the MX record so Yandex can receive mail
On the Domains page Yandex shows the MX record for receiving: host @, value mx.yandex.net. (with the trailing dot), priority 10, TTL 21600. Add it at your DNS host. MX is about receiving, not authentication, but it's part of standing up a Yandex 360 mailbox and mail won't flow without it.
- 3
Publish or merge the SPF record
At your DNS host add one TXT record on the root (host @): v=spf1 include:_spf.yandex.net ~all. If you send only through Yandex you can instead use Yandex's shortcut v=spf1 redirect=_spf.yandex.net. If a v=spf1 record already exists (Google, a marketing tool, etc.), merge include:_spf.yandex.net into that single record — never publish a second SPF TXT. Use TTL 21600 if a value is required.
- 4
Generate the DKIM key
Back on the Domains page, click Add DKIM next to the domain. Yandex opens the Configure DKIM signature panel and generates a key pair for you — copy the full public-key value it displays. If you delegated your domain's nameservers to Yandex, the DKIM record is created automatically and you can skip the manual publish.
- 5
Publish the DKIM TXT record
Create a TXT record with host mail._domainkey (some panels want the full mail._domainkey.yourdomain.tld) and paste the value Yandex gave you — it looks like v=DKIM1; k=rsa; t=s; p=<long public key>. This is a TXT record, not a CNAME, and Yandex uses the single selector mail. TTL 21600 if required.
- 6
Add the DMARC record
Yandex recommends DMARC but doesn't create it. Add a TXT record at host _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so nothing about delivery changes while you confirm Yandex mail passes SPF and DKIM aligned — you'll tighten it later.
- 7
Run Yandex's domain check
Return to the Domains page, click Verify your domain next to the domain, and click Check. Yandex re-reads your DNS; propagation can take up to 72 hours. If a record shows as not found, don't re-add it — wait and click Check again, or re-copy the exact value from the DKIM panel.
- 8
Send a test and read the headers
From a mailbox on the domain, email yourself at a Gmail account, open the message, and choose ⋮ → Show original. You want SPF: PASS showing your domain, DKIM: PASS with d=yourdomain.com and selector mail (not a yandex.ru/yandex.net domain), and DMARC: PASS. Then confirm every record resolves with a domain health check.
Records to add
Yandex 360 generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.yandex.net ~allRoot SPF — keep exactly ONE SPF record; merge this include if you already have a v=spf1 line. Costs ~4 DNS lookups (redirect chain). Yandex-only? Use v=spf1 redirect=_spf.yandex.net instead. |
| TXT | mail._domainkey | v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ…(public key from Configure DKIM signature)Illustrative — the real key is generated per domain in Domains → Add DKIM. This is a TXT record (not a CNAME), single selector mail, and the value carries the t=s (strict) flag. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comYou add this yourself — Yandex never creates it. One DMARC record per domain; start at p=none, then tighten to quarantine/reject. |
| MX | @ | mx.yandex.net.Priority 10, TTL 21600. Routes inbound mail to Yandex 360 — not an authentication record, but part of the mailbox setup. Keep the trailing dot. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Yandex 360's setup costs against that budget.
Yandex 360 adds 4 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM for Yandex 360 is generated inside the admin console, not copied from a fixed value and not delegated by CNAME. On the Domains page, click Add DKIM for the domain; Yandex opens Configure DKIM signature and creates the key pair for you, then shows a public key you publish as a single TXT record at host mail._domainkey with a value like v=DKIM1; k=rsa; t=s; p=<public key>. Several things make Yandex DKIM different from Google or Microsoft. First, it's a TXT record you paste — there's no CNAME delegation and no s1/s2-style rotation pair; Yandex uses one selector, mail, and holds the private key on its side. Second, the published value carries the t=s flag, DKIM's strict mode, which means the signing identity must match the exact domain — a key on yourdomain.com won't validate mail signed as a subdomain, so a subdomain that sends mail needs its own DKIM set up separately. Third, Yandex generates the RSA key for you: you can't paste your own key or pick the length in the basic panel (Yandex-issued keys have historically been 1024-bit), so there's no bit-length choice to make the way there is in Google Workspace. Publishing the record is not the finish line — go back to the Domains page and click Verify your domain → Check so Yandex confirms the key resolves and begins signing with d=yourdomain.com. And if you delegated your nameservers to Yandex, the DKIM record is created for you automatically; you only do the manual TXT publish when your DNS lives at an outside registrar.
DMARC
DMARC is a separate policy TXT record you publish yourself — Yandex recommends it but never creates it. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only: it changes nothing about delivery but tells receivers to email you aggregate reports so you can confirm that Yandex mail is passing SPF and DKIM aligned to your domain before you enforce anything. Because Yandex 360 aligns both mechanisms — SPF via your own envelope domain and DKIM via the mail selector on your domain — you should see clean passes quickly, and the setup survives forwarding on the DKIM side. Watch the rua reports for a week or two, make sure every legitimate sender (Yandex plus any third-party tools) is authenticating, then tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain regardless of how many senders you use; subdomains inherit the parent policy unless you give them their own _dmarc record or use the sp= tag. A useful bonus: Yandex is also a mailbox provider that generates DMARC aggregate reports, so once you publish a rua address you'll start receiving Yandex's own reports on how your domain's mail is authenticating in the wild.
Check it actually worked
Don't trust the Yandex Domains page badge alone — confirm it on a real message. Send yourself a test from a mailbox on the domain, open it in Gmail, and choose ⋮ → Show original: you want SPF: PASS showing your domain, DKIM: PASS with d=yourdomain.com and selector mail (the tell-tale failure is a signature from a yandex.ru/yandex.net domain, which means custom DKIM isn't active yet), and DMARC: PASS. You can spot-check the raw records with dig TXT mail._domainkey.yourdomain.com, dig TXT yourdomain.com (for SPF), and dig TXT _dmarc.yourdomain.com. Yandex also exposes delivery and authentication statistics through Yandex Postmaster (postmaster.yandex.ru) once you add and verify the domain there. Finally, run the domain through Qualisend's domain health check to confirm the SPF (and that its ~4-lookup redirect chain keeps you under the 10-lookup limit), the mail._domainkey DKIM record, and the DMARC record all resolve cleanly — and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer to see Yandex show up as an aligned, passing source.
Common gotchas
- DNS setup
include:_spf.yandex.net is NOT one DNS lookup. It redirects internally (_spf.yandex.net → _spf.yandex.ru → _spf-ipv6 + _spf-ipv4-yc), so it burns about 4 of your 10 SPF lookups. Most guides and cached checkers say 1 — plan for 4 when you stack Yandex with other senders.
- DNS setup
redirect vs include: v=spf1 redirect=_spf.yandex.net is the WHOLE record and can't hold anything else. The moment you also send via Google, SendGrid, or your own server, you must switch to the include form — and never publish both.
- DNS setup
Yandex DKIM is a TXT record, not a CNAME, and there's only one selector (mail) with no rotation pair. Generating the key in the Configure DKIM signature panel isn't enough — you must publish the TXT and then click Verify your domain → Check.
- Coverage
The DKIM value ships with t=s (strict mode), so the key on your root domain won't validate mail signed as a subdomain. A subdomain that sends mail needs its own DKIM setup.
- Coverage
You can't bring your own DKIM key or choose the key length in the basic panel — Yandex generates it (historically 1024-bit). If you need a stronger key you're limited to what Yandex issues.
- Coverage
Registrar host-doubling: enter mail._domainkey (not mail._domainkey.yourdomain.com) and @ for the root SPF/MX — many panels auto-append your domain, producing mail._domainkey.yourdomain.com.yourdomain.com.
- Breaks auth
Keep exactly one SPF and one DMARC record. If you already send via Google Workspace, Microsoft 365, or a marketing tool, merge include:_spf.yandex.net into the single v=spf1 line — two SPF TXT records is a PermError.
- Coverage
Propagation can take up to 72 hours and the Yandex status page lags. Use the Check button to re-poll; don't re-add or duplicate a record that just hasn't propagated yet.
Build your SPF record
Yandex 360 is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listYandex 360 SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.