SPF record for MailerSend

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

MailerSend only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.mailersend.net ~all

Google Workspace and MailerSend

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:_spf.mailersend.net ~all

Return path (CNAME, not TXT)

Type: CNAME · Host: mta Copy

mailersend.net

mta is MailerSend's default host; you can change it with Edit on the Domains page.

How SPF applies to MailerSend mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). MailerSend sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• MailerSend needs SPF, both DKIM CNAMEs and the return-path CNAME to verify the domain. Tracking CNAMEs are needed only if you turn on custom DNS records for tracking.
• MailerSend's API example shows its SPF value ending in -all and including an IPv6 range. Copy your account's exact value rather than this page's examples.
• Some DNS hosts treat the host field differently: MailerSend says to leave it empty for SPF on Wix and Google Domains, and not to use @ on Google Cloud DNS.

How to add it

1. In MailerSend, go to Email > Domains, click Add domain, enter the domain and click Add domain again.
2. Choose automatic authentication through your registrar login, or close the pop-up to set up the records by hand.
3. Replace your existing SPF TXT record on @ with the value MailerSend shows, which already includes what you had. Don't add a second SPF record.
4. Add the two DKIM CNAMEs and the mta return-path CNAME, tick I have added DNS records and click Finish verification.
5. MailerSend says verification usually takes minutes but can take up to 48 hours; use Re-check now after that, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

The mta return path is a subdomain of yours, so SPF for MailerSend mail is checked there and can align under relaxed DMARC alignment. The two DKIM CNAMEs carry MailerSend's 2048-bit keys and give a second aligned pass. MailerSend doesn't create a DMARC record for you. See our MailerSend DKIM page.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). MailerSend's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. MailerSend's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding MailerSend's value as a second SPF record. MailerSend says there can't be more than one SPF record in a DNS zone.
• Typing mta.example.com as the host where your DNS host appends the domain. For Google Domains, MailerSend says to enter only mta.
• Skipping the return-path CNAME. MailerSend counts it among the records needed to verify the domain.