Set up SPF, DKIM and DMARC for your sending domain

Before you start

• Access to the DNS of your From domain, the part after @ in the mailbox's From Email.
• The records from your sending provider. For Amazon SES they are on the domain identity: Configuration → Identities, your domain, Authentication tab, Publish DNS records.
• Who signs. NetSendo does not add a DKIM signature to mail it sends through SMTP, SendGrid or Gmail mailboxes; the provider signs it once you set up DKIM there.
• For the checks in NetSendo: a GOLD licence. Without it, Settings → Deliverability Shield shows the offer with Upgrade to GOLD, and adding, verifying and refreshing domains and the record generators are locked. The DNS records themselves work on any licence.
• A public APP_URL. On localhost, 127.0.0.1 or a host ending in .local, .test, .localhost or .dev, NetSendo shows Local Environment Detected and cannot verify domains.
• How SPF, DKIM and DMARC fit together: deliverability guide.

Steps

1. In your sending provider, open the DKIM records for your domain. Amazon SES Easy DKIM shows three CNAME records of the form <token>._domainkey.example.com → <token>.dkim.amazonses.com.
2. Add those records at your DNS provider exactly as shown.
3. For SPF, decide on the envelope (MAIL FROM) domain. SES uses a subdomain of amazonses.com by default, which SES covers. For SPF aligned with your domain, set a custom MAIL FROM subdomain in SES and publish its MX record 10 feedback-smtp.<region>.amazonses.com and TXT record v=spf1 include:amazonses.com ~all.
4. Publish DMARC: a TXT record on _dmarc.example.com, for example v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. Start with p=none and tighten later, as the guide explains.
5. In NetSendo, open Settings → Deliverability Shield.
6. Click Add Domain.
7. In Domain name, type your From domain, for example example.com.
8. Click Add Domain. The domain page opens with Verification Required.
9. Copy the record under Add this record:: type CNAME, host _netsendo.example.com, target ns- plus 12 characters plus your NetSendo host name, TTL 3600.
10. Add that CNAME at your DNS provider.
11. Click Verify Now.
12. After every DNS change, click Refresh and read Status Overview.

Check that it works

After Verify Now you see "Domain verified successfully!" and the domain is marked Verified under Your Domains. NetSendo then checks:

The overall status is pending until the CNAME is verified; then any critical record makes it critical, any warning a warning, any pending record pending, and three valid records safe. Verified domains are re-checked every six hours.

Check outside NetSendo too: dig +short TXT _dmarc.example.com, dig +short CNAME <token>._domainkey.example.com. Send yourself a test and look for dkim=pass and dmarc=pass in the Authentication-Results header.

If it doesn't work

"CNAME record not found. Please check your DNS settings."

The record has not propagated yet (wait and click Verify Now again), your DNS panel appended the domain a second time (enter only _netsendo as the name), or the target differs. The target is built from the host in APP_URL, so after changing APP_URL copy it again from the domain page.

Add Domain stays greyed out

The field accepts only name.tld: no subdomains such as mail.example.com and no two-part endings such as example.co.uk.

DKIM stays pending with Amazon SES

Easy DKIM uses random token selectors, and NetSendo checks only default, mail and dkim for SMTP mailboxes. DKIM therefore stays pending and the overall status never reaches safe. Confirm DKIM in the SES console instead (the identity's DKIM configuration shows Successful). With SES BYODKIM you choose the selector: name it mail, default or dkim and NetSendo finds it.

The generators suggest records you should not publish

One-Click Fix → Show Generator opens the DMARC Generator and SPF Generator.

• The SPF Generator knows only SendGrid, Gmail and NetSendo MTA. For SMTP mailboxes such as SES it proposes v=spf1 include:_spf.<your NetSendo host> -all. Don't publish that: it replaces your SPF record and fails every other sender of the domain.
• The DMARC Generator starts at p=quarantine with strict alignment (adkim=s; aspf=s) and reports to dmarc-reports@<your domain>. Strict alignment fails when the signing or envelope domain is only a parent or subdomain of your From domain, and that report address must exist. Start with p=none.

Records are valid but the badges stay red

In 2.7.0 the SPF, DKIM and DMARC badges under Your Domains can stay red, and the cards in Status Overview grey, even for valid records. Read the text in each card instead. It can show an untranslated key such as deliverability.spf.valid; the last word is the result.

You send through NMI (NetSendo MTA)

NMI is a GOLD feature with its own DKIM keys per dedicated IP, managed under Settings → Mail Infrastructure. Its setup is described in the configuration docs.