SPF record for MailerLite

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

MailerLite only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.mlsend.com ~all

MailerLite and Microsoft 365 (MailerLite's merge example)

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 a mx include:spf.protection.outlook.com include:_spf.mlsend.com ~all

MailerLite's example keeps the a and mx mechanisms. Drop them if your web server and inbound mail servers don't send mail as your domain.

MailerLite and Google Workspace

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:_spf.mlsend.com ~all

How SPF applies to MailerLite mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). MailerLite sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• MailerLite's troubleshooting article also shows the record as v=spf1 a mx include:_spf.mlsend.com ?all. Whatever qualifier you pick, a merged record ends with a single all.
• MailerLite says propagation usually finishes within 24 hours and can take up to 72. Authentication is required to send from a custom domain once the 14-day trial ends.
• MailerLite points out that SPF values are case-sensitive and that one TXT string holds at most 255 characters.

How to add it

1. In MailerLite, go to Account settings, open the Domains tab and click + Add sending domain. Enter the sending address and click Save.
2. Choose automatic setup if MailerLite offers it for your DNS provider, or Authenticate manually to copy the records yourself.
3. At the company that actually hosts your DNS, add the three records MailerLite shows: the DKIM CNAME, the SPF TXT record and a verification TXT record.
4. If a TXT record starting with v=spf1 already exists on that host, add include:_spf.mlsend.com to it rather than creating a second one.
5. Back in MailerLite, click the … button next to the domain and choose Check DNS records. The status moves from Authentication in process to Authenticated.

DKIM and DMARC alignment

MailerLite's DKIM record is a CNAME named litesrv._domainkey that points to litesrv._domainkey.mlsend.com (see our MailerLite DKIM page). That DKIM signature is what lets MailerLite campaigns pass DMARC for your domain, so publish a DMARC record once both records verify.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). MailerLite's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. MailerLite's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Two SPF records after adding MailerLite's value next to an existing one. MailerLite says you can only have one SPF record in your DNS zone; merge them.
• Adding the records at your registrar when another company (a web host or Cloudflare, for example) runs your DNS. MailerLite sees no change until they are in the right zone.
• Copying the value with different capitals or missing characters. MailerLite compares it exactly and suggests a text-compare tool to spot the difference.