SPF record for Mailjet

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Mailjet only (Mailjet's value)

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.mailjet.com ~all

Mailjet and Microsoft 365

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:spf.mailjet.com ~all

Mailjet and Google Workspace

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:spf.mailjet.com ~all

How SPF applies to Mailjet mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Mailjet sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Mailjet explains the qualifiers but leaves the choice to you: ~all marks unlisted servers as suspicious, -all rejects them and ?all is neutral. Its own value uses ~all.
• Mailjet reminds you that SPF is published as a TXT record; the old SPF record type isn't recommended.

How to add it

1. In Mailjet, add and validate your sending domain (Account Settings, Domains and Sender addresses). Mailjet then shows the SPF and DKIM values for it.
2. Sign in to your DNS host and look for a TXT record on @ that starts with v=spf1.
3. If there is one, add include:spf.mailjet.com to it. If there isn't, create a TXT record with v=spf1 include:spf.mailjet.com ~all.
4. Add the DKIM TXT record at mailjet._domainkey as well, using the key from your account.
5. Check the result in Mailjet: Mailjet says an authenticated domain shows a green check mark next to SPF and DKIM. DNS can take from a few minutes to 48 hours.

DKIM and DMARC alignment

Mailjet's DKIM key is a TXT record at mailjet._domainkey, with a key Mailjet generates (2048 bits by default). See our Mailjet DKIM page. Mailjet also recommends a DMARC record, while noting its support only gives guidelines for DMARC rather than doing the setup for you.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Mailjet's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Mailjet's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Keeping two v=spf1 records, one for Mailjet and one for your mailbox provider. Mailjet's own example merges them into a single line.
• Choosing the obsolete SPF record type in your DNS host instead of TXT.