# SPF record for Fastmail

URL: https://iblockspam.com/spf/fastmail
Last updated: 2026-10-09

Include: include:spf.messagingengine.com
Where it goes: Your domain (@)
DNS lookups: 1 of 10

Fastmail's manual DNS guide gives the SPF record v=spf1 include:spf.messagingengine.com ?all on the root of your domain. The include costs 1 DNS lookup. The ?all ending is neutral: it makes no claim about other servers. Many domain owners use ~all or -all instead, once every sender is listed.

## Example records

- Fastmail only (as Fastmail documents it) (TXT, host @): `v=spf1 include:spf.messagingengine.com ?all`
- Fastmail only, with a soft fail ending (TXT, host @): `v=spf1 include:spf.messagingengine.com ~all`
- Fastmail and Zendesk (TXT, host @): `v=spf1 include:spf.messagingengine.com include:mail.zendesk.com ~all`

## Notes

- The SPF include is not your MX host. Fastmail's inbound MX records are `in1-smtp.messagingengine.com` (priority 10) and `in2-smtp.messagingengine.com` (priority 20); they don't belong in SPF.
- Fastmail's DNS guide also lists a starter DMARC record, `v=DMARC1; p=none;`, to publish once SPF and DKIM are in place.
- RFC 7208 defines `?all` (neutral) as the domain owner explicitly not saying whether other servers are allowed. Receivers treat it like having no policy for those servers.

## How to add it

- At your DNS host, look for an existing TXT record on the root of your domain that starts with `v=spf1`.
- Add `include:spf.messagingengine.com` to it, or create a TXT record with one of the values above.
- Add Fastmail's three DKIM CNAME records (below) at the same time.
- Save, then check the live record with the SPF Checker below.

## DKIM and DMARC

Fastmail signs with DKIM through three CNAME records: `fm1._domainkey` pointing to `fm1.yourdomain.com.dkim.fmhosted.com`, and the same for `fm2` and `fm3`. Publish all three. Domains set up before 2018 may also have a deprecated `mesmtp._domainkey` CNAME. With DKIM in place, add a [DMARC record](https://iblockspam.com/blog/dmarc-record-examples).

## Common mistakes

- Publishing only `fm1._domainkey`. Fastmail says you need all three DKIM CNAME records.

**Q: What is the SPF record for Fastmail?**
Fastmail's manual DNS guide gives `v=spf1 include:spf.messagingengine.com ?all` as a TXT record on the root of your domain. If other services send as your domain, add their includes to the same record.

**Q: Why does Fastmail's record end in ?all?**
`?all` is neutral: it neither allows nor rejects servers that aren't listed. It is the safest choice when you aren't sure every sender is listed, but it gives receivers no signal against spoofing. Once you've listed all senders, `~all` or `-all` is stronger. See our [soft fail vs hard fail guide](https://iblockspam.com/blog/spf-softfail-vs-hardfail).

**Q: Which DKIM records does Fastmail need?**
Three CNAME records: `fm1._domainkey`, `fm2._domainkey` and `fm3._domainkey`, pointing to `fm1.yourdomain.com.dkim.fmhosted.com` and so on. Fastmail asks you to publish all three.

Sources:
- Fastmail Help: Manual DNS configuration: https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration
- RFC 7208 section 2.6: Results of evaluation: https://www.rfc-editor.org/rfc/rfc7208.html#section-2.6

---

Source: iBlockSpam, https://iblockspam.com/spf/fastmail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt