Setup guides
SPF, DKIM and DMARC, depending on who sends for you.
Three DNS records are enough to authenticate your email — but their exact content depends on your provider, and the order you publish them decides whether you break your own legitimate mail on the way.
Your mailbox provider
The provider hosting your mailboxes and sending your day-to-day mail.
Google Workspace
The DKIM switch nobody remembers to click, aliases that inherit nothing, and delegation that breaks alignment.
Microsoft 365
The two CNAMEs pointing at your tenant, dots replaced by dashes, and the toggle in the Defender portal.
OVHcloud
A single include for every plan, and automatic DKIM that only works if the DNS zone lives there too.
Infomaniak
The -all published by default from day one, and why several DKIM records can coexist.
Gandi
Three DKIM CNAMEs instead of one, and the documented ?all that asserts nothing.
o2switch
The Jabatus include, one-click DKIM from cPanel, and the website that sends without anyone noticing.
iCloud Mail
The redirect= Apple suggests, which replaces your whole SPF instead of adding to it.
Cloudflare Email Routing
It forwards, it does not send: the one case where going straight to reject is the right call.
Your sending platforms
They send in your name: that is where alignment is decided, and where moving to reject does the most damage.
Mailjet
SPF passes without aligning. DKIM is not a comfort option there, it is what makes you compliant.
Brevo
Neither SPF nor MX required, and a code that verifies without authenticating: what you actually publish.
SendGrid
The delegated subdomain that aligns SPF too — and the underscore CNAME limitation.
Amazon SES
Easy DKIM is not enough: without a custom MAIL FROM domain, SPF never aligns.
Mailchimp
Marketing and Transactional need different records. The leading cause of failure.
Mailgun
Everything goes on the sending subdomain, and the tracking CNAME has nothing to do with authentication.
Postmark
The custom Return-Path is what aligns SPF. Skipping it leaves DMARC resting on DKIM alone.
Klaviyo
NS delegation of a whole subdomain, and different selectors per domain type.
SparkPost
Sending domain and bounce domain are two things: the second is what aligns SPF.
ActiveCampaign
DKIM moved from TXT to CNAME in 2023: the older tutorials cost you a day.
GetResponse
A hexadecimal selector, and the duplicated domain that silently breaks the record.
Constant Contact
CNAME self-authentication, and the case that rules it out: several accounts on one domain.
Kit (ConvertKit)
Full or relative host name depending on the zone editor: the leading cause of failed verification.
Your provider missing? Tell us: the writing order follows real requests, and every guide is written from the provider’s official documentation, not from a recycled template.
Once your records are published
A setup that is correct on the day does not stay that way. Clarsend watches alignment over time and tells you when it degrades.