SPF record for Campaign Monitor

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Campaign Monitor only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.createsend.com ~all

Campaign Monitor and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.createsend.com include:spf.protection.outlook.com -all

A sending subdomain such as mail.example.com

Type: TXT · Host: mail · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.createsend.com ~all

Use the subdomain label as the host. Authenticating example.com doesn't cover mail.example.com, and the reverse is also true.

How SPF applies to Campaign Monitor mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Campaign Monitor sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Campaign Monitor says the default SPF it handles covers the domains in the Return-Path address, so SPF passes for its mail even before you add the include. DMARC can still pass through DKIM.
• If you don't manage DNS yourself, Share instructions in Campaign Monitor sends the exact records to whoever does.

How to add it

1. In Campaign Monitor, click your profile image (top right), choose Account settings, then Sending domains, and click Set up a sending domain (or Add domain).
2. Enter the exact domain or subdomain you send from, such as mail.example.com. Generic mailbox domains and unregistered domains are refused.
3. Publish the DKIM TXT record (cm._domainkey) and, if the domain has no DMARC record yet, the _dmarc record Campaign Monitor shows.
4. For SPF, edit the TXT record on the same host that starts with v=spf1 and add include:_spf.createsend.com straight after v=spf1. With no record, create v=spf1 include:_spf.createsend.com ~all.
5. Use a TTL of at least 300 seconds (GoDaddy's minimum is 600), then click Re-check record in Sending domains.

DKIM and DMARC alignment

Campaign Monitor treats DKIM and DMARC as the required records: a TXT key at cm._domainkey on your sending domain plus a _dmarc record (see our Campaign Monitor DKIM page). Without DKIM, Gmail shows "via" and Outlook shows "sent by" next to your name. For DMARC, the From domain has to match the domain in the DKIM signature.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Campaign Monitor's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Campaign Monitor's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Authenticating the root domain and sending from a subdomain (or the other way round). Each sending domain needs its own records.
• Creating a second v=spf1 record on the host instead of adding the include to the existing one.
• A DNS host that strips underscores or semicolons. Campaign Monitor says you may be able to escape a semicolon as \;, but a host without underscore support can't hold the records.