SPF record for Squarespace Email Campaigns

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Squarespace mail

Squarespace sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Squarespace says the records can take up to 48 hours to resolve, depending on your provider.
• Domains bought from Squarespace, or migrated to it from Google Domains, are verified automatically and need no records.
• If your domain's DMARC policy is p=reject, Squarespace says you can't use your sender details until the domain is verified.

How to add it

1. In Squarespace, open the Email Campaigns settings panel, add a sender name and address, and enter the code sent to that address.
2. Under Sender details, click Authenticate to see the CNAME and TXT records.
3. At your DNS host, add the CNAME squarespace._domainkey with the value squarespace-domainkey.squarespace-mail.com, and the TXT record at _dmarc with the unique value Squarespace shows.
4. Leave your SPF record unchanged. When "Domain is unauthenticated" no longer appears under your domain in the sender details, the domain is verified.

DKIM and DMARC alignment

The CNAME at squarespace._domainkey is a DKIM record: it lets Squarespace sign campaigns with your domain, which is what lets them pass DMARC without SPF. See our Squarespace DKIM page. The TXT record Squarespace gives is a DMARC record; a domain should have only one, so merge rather than add a second.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Squarespace adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding an old Squarespace SPF value from a past guide. Squarespace removed the SPF requirement.
• Entering the DMARC value as a second _dmarc record when your domain already has one.
• Typing squarespace._domainkey.example.com at a DNS host that appends the domain itself, which doubles the name.