Set up DMARC with Mailjet

Mailjet does not host mailboxes; it is a sending platform, dispatching in your name. The whole DMARC difficulty sits in that distinction, and it turns on one word — alignment.

SPF

Add the Mailjet mechanism to your existing SPF record:

v=spf1 include:spf.mailjet.com include:_spf.google.com ~all

The example combines Mailjet and Google Workspace, which is the common case, and it illustrates the rule: a domain has one SPF record, listing every sender.

DKIM

Publish a TXT record on the host mailjet._domainkey.yourdomain.com, with the public key from your Mailjet account, in the SPF/DKIM authentication section. It looks like k=rsa; p=MIGfMA0GCSqGSIb3DQ….

What actually matters: alignment

By default, Mailjet sends with its own envelope address. The result: SPF passes — Mailjet’s servers are indeed authorised — but it validates Mailjet’s domain, not yours. For DMARC that counts as a failure, because the validated domain does not match the one shown in the From: header.

DKIM is what saves it: signed with a key published on your domain, it aligns. On a sending platform, DKIM is therefore not a comfort option — it is what makes you DMARC-compliant. That distinction between raw and aligned results is the number one source of confusion when reading reports.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Stay there long enough to identify every legitimate sender before tightening. The progression, step by step.

Common mistakes with Mailjet

• Assuming SPF is enough. It passes, it does not align. Without DKIM, moving to p=reject makes your campaigns disappear.
• The ten DNS lookup limit. Every include consumes one; past ten, the entire record becomes invalid — and the failure is silent.
• A second SPF record created « for Mailjet » alongside the existing one: the two cancel each other out.
• A sender address on a domain other than the authenticated one: alignment is judged on the From: domain, not on the Mailjet account.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge — without opening a single XML file.