# SPF record for Customer.io

URL: https://iblockspam.com/spf/customer-io
Last updated: 2026-11-03

Include: Copy from Customer.io (cio##### subdomain)
Where it goes: Customer.io's account subdomain (cio#####)
DNS lookups: depends on your account

Customer.io's SPF record doesn't go in your root SPF record. Customer.io gives you a TXT record for an account-specific subdomain such as cio12345.example.com, next to an MX record that makes that subdomain the return path. SPF is checked there, so it doesn't use any of your root record's 10 lookups and still aligns with your From domain.

## Example records

- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- Publish Customer.io's SPF value as an ordinary TXT record, not the old SPF record type.
- On Amazon Route 53, which allows one MX record per name, Customer.io says to put both MX values in one record on separate lines; its example is `10 mxa.mailgun.org.` and `10 mxb.mailgun.org.`.
- Wix doesn't accept an MX record on a subdomain, so Customer.io says such domains can't be verified there.

## How to add it

- In Customer.io, go to **Settings > Workspace Settings > Email**, add a sending domain and a from address, then click **Show Records**.
- Add the four records at your DNS host: the MX record (two hostnames) and the SPF TXT record on your `cio#####` subdomain, the DKIM TXT record on `cio._domainkey.cio#####`, and DMARC on `_dmarc` of your root domain.
- If your DNS host appends your domain automatically (GoDaddy does), enter only the front part, such as `cio12345`.
- Click **Verify domain**. Customer.io only checks when you click, and says verification can take up to 72 hours. SPF, DKIM and DMARC all need a green checkmark before you can send.

## DKIM and DMARC

DKIM is a 2048-bit TXT key at `cio._domainkey.cio#####.yourdomain.com` (see our [Customer.io DKIM page](https://iblockspam.com/dkim/customer-io)). Because the return path and DKIM sit on a subdomain of your From domain, both align under DMARC's relaxed default. Customer.io warns that `aspf=s` or `adkim=s` in your DMARC record makes its mail fail alignment.

## Common mistakes

- Putting Customer.io's SPF value into the root record on `@`. It belongs on the `cio#####` subdomain.
- Deleting your domain's existing MX or SPF records while adding Customer.io's. Customer.io warns you could stop receiving email.
- Removing the Customer.io records after verification, which Customer.io says can cause bounces or spam filtering.

**Q: Does Customer.io need an include in my root SPF record?**
No. Customer.io's SPF TXT record goes on your account subdomain (`cio#####.yourdomain.com`), which is also the return path, so receivers check SPF there and your root record is untouched.

**Q: Why does Customer.io ask for an MX record on a subdomain?**
The MX record makes your `cio#####` subdomain the custom return path, which receives bounces and spam feedback. It sits on the subdomain, so it doesn't affect mail delivered to your own mailboxes.

**Q: Will a strict DMARC policy break Customer.io mail?**
Strict alignment will. Customer.io signs and returns mail on a subdomain of your From domain, which passes relaxed alignment only. If your DMARC record has `aspf=s` or `adkim=s`, change them to `r` or remove them.

Sources:
- Customer.io Docs: Domain authentication: https://docs.customer.io/journeys/authentication/

---

Source: iBlockSpam, https://iblockspam.com/spf/customer-io (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt