SPF record for Customer.io

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Customer.io mail

Customer.io sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for Customer.io. Customer.io doesn't print its SPF value in its documentation. Copy it from Show Records in your workspace and publish it on the cio##### host, not on @.

• Publish Customer.io's SPF value as an ordinary TXT record, not the old SPF record type.
• On Amazon Route 53, which allows one MX record per name, Customer.io says to put both MX values in one record on separate lines; its example is 10 mxa.mailgun.org. and 10 mxb.mailgun.org..
• Wix doesn't accept an MX record on a subdomain, so Customer.io says such domains can't be verified there.

How to add it

1. In Customer.io, go to Settings > Workspace Settings > Email, add a sending domain and a from address, then click Show Records.
2. Add the four records at your DNS host: the MX record (two hostnames) and the SPF TXT record on your cio##### subdomain, the DKIM TXT record on cio._domainkey.cio#####, and DMARC on _dmarc of your root domain.
3. If your DNS host appends your domain automatically (GoDaddy does), enter only the front part, such as cio12345.
4. Click Verify domain. Customer.io only checks when you click, and says verification can take up to 72 hours. SPF, DKIM and DMARC all need a green checkmark before you can send.

DKIM and DMARC alignment

DKIM is a 2048-bit TXT key at cio._domainkey.cio#####.yourdomain.com (see our Customer.io DKIM page). Because the return path and DKIM sit on a subdomain of your From domain, both align under DMARC's relaxed default. Customer.io warns that aspf=s or adkim=s in your DMARC record makes its mail fail alignment.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Putting Customer.io's SPF value into the root record on @. It belongs on the cio##### subdomain.
• Deleting your domain's existing MX or SPF records while adding Customer.io's. Customer.io warns you could stop receiving email.
• Removing the Customer.io records after verification, which Customer.io says can cause bounces or spam filtering.