# SPF record for SparkPost

URL: https://iblockspam.com/spf/sparkpost
Last updated: 2026-11-03

Include: None needed (bounce-domain CNAME)
Where it goes: Not needed (bounce-domain CNAME)
DNS lookups: 0 on your domain

SparkPost doesn't ask for an include in your root SPF record. SPF for SparkPost mail is checked on the bounce domain, the return-path address. To put it on your own domain, create a subdomain with a CNAME pointing to sparkpostmail.com (eu.sparkpostmail.com for SparkPost EU) and verify it as a bounce domain. Sign with DKIM too.

## Example records

- Bounce domain on a subdomain (CNAME, not TXT) (CNAME, host bounces): `sparkpostmail.com` SparkPost EU accounts point to eu.sparkpostmail.com. Enterprise accounts use <public_tenant_id>.mail.e.sparkpost.com.
- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- A bounce domain can be used only once its CNAME status is valid; MX verification is limited to Enterprise accounts.
- Because the bounce subdomain is a CNAME, SPF lookups for it follow the CNAME to SparkPost's own published record. On 3 November 2026, `sparkpostmail.com` published `v=spf1 exists:%{i}._spf.sparkpostmail.com ~all`.
- A CNAME can't share a name with other records, so use a subdomain that has no MX, TXT or A record.

## How to add it

- Create the sending domain in SparkPost and publish its DKIM TXT record (see our SparkPost DKIM page).
- Pick a subdomain for bounces, such as `bounces.example.com`, and create a CNAME there pointing to `sparkpostmail.com`, or `eu.sparkpostmail.com` for SparkPost EU.
- Add the subdomain as a sending domain and verify it with CNAME verification (`cname_verify` in the API).
- Once its CNAME status is valid, set it as your default bounce domain (`is_default_bounce_domain`) or pass it in each transmission's `return_path`.
- Verify within two weeks: SparkPost removes sending domains that stay unverified longer. Leave your root SPF record unchanged.

## DKIM and DMARC

SparkPost signs with your domain once its DKIM TXT record is verified, and that aligned DKIM pass is what DMARC needs. A bounce subdomain of your From domain adds SPF alignment under relaxed mode. SparkPost warns that verifying a domain by mailbox instead of DNS means it can't DKIM-sign your mail. See our [SparkPost DKIM page](https://iblockspam.com/dkim/sparkpost).

## Common mistakes

- Adding an include for SparkPost to your root SPF record. SPF is checked on the bounce domain, so the root include spends lookups without changing results.
- Using a US account target (`sparkpostmail.com`) on a SparkPost EU account, or the other way round. The CNAME must point at your account's own domain.
- Setting `aspf=s` in DMARC. A bounce subdomain only aligns with your From domain under relaxed SPF alignment.

**Q: Do I add include:sparkpostmail.com to my SPF record?**
Not to your root record. SPF for SparkPost mail is evaluated on the bounce (return-path) domain. Point a subdomain at `sparkpostmail.com` with a CNAME and verify it as a bounce domain; the CNAME brings SparkPost's SPF record with it.

**Q: What CNAME does a SparkPost EU bounce domain use?**
`eu.sparkpostmail.com`. US accounts point to `sparkpostmail.com`, and Enterprise accounts to `<public_tenant_id>.mail.e.sparkpost.com`. The target has to match the region your account runs in.

**Q: How do I make a SparkPost bounce domain the default?**
After the CNAME verifies, set `is_default_bounce_domain` on that sending domain. SparkPost then uses it whenever a transmission doesn't name another bounce domain in its `return_path` field.

Sources:
- SparkPost API Reference: Sending Domains: https://developers.sparkpost.com/api/sending-domains/

---

Source: iBlockSpam, https://iblockspam.com/spf/sparkpost (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt