SPF record for Fastmail

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Fastmail only (as Fastmail documents it)

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.messagingengine.com ?all

Fastmail only, with a soft fail ending

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.messagingengine.com ~all

Fastmail and Zendesk

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.messagingengine.com include:mail.zendesk.com ~all

How SPF applies to Fastmail mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Fastmail sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• The SPF include is not your MX host. Fastmail's inbound MX records are in1-smtp.messagingengine.com (priority 10) and in2-smtp.messagingengine.com (priority 20); they don't belong in SPF.
• Fastmail's DNS guide also lists a starter DMARC record, v=DMARC1; p=none;, to publish once SPF and DKIM are in place.
• RFC 7208 defines ?all (neutral) as the domain owner explicitly not saying whether other servers are allowed. Receivers treat it like having no policy for those servers.

How to add it

1. At your DNS host, look for an existing TXT record on the root of your domain that starts with v=spf1.
2. Add include:spf.messagingengine.com to it, or create a TXT record with one of the values above.
3. Add Fastmail's three DKIM CNAME records (below) at the same time.
4. Save, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Fastmail signs with DKIM through three CNAME records: fm1._domainkey pointing to fm1.yourdomain.com.dkim.fmhosted.com, and the same for fm2 and fm3. Publish all three. Domains set up before 2018 may also have a deprecated mesmtp._domainkey CNAME. With DKIM in place, add a DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Fastmail's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Fastmail's documentation uses ?all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Publishing only fm1._domainkey. Fastmail says you need all three DKIM CNAME records.