How do I set up SPF, DKIM, and DMARC? | AgentMail

SPF, DKIM, and DMARC are three email authentication protocols that prove your emails are legitimate. They are essential for deliverability: Gmail, Outlook, and other major providers now require all three for reliable inbox placement.

AgentMail provides all three records automatically when you add a custom domain. You just need to add them to your DNS provider.

SPF (Sender Policy Framework)

SPF tells receiving servers which mail servers are authorized to send email for a domain. Receivers check SPF against the envelope sender (the Return-Path, also called MAIL FROM), which can be a different hostname from the address in the visible From header.

AgentMail sends from a dedicated MAIL FROM subdomain, mail.yourdomain.com. The SPF record goes on that subdomain, together with an MX record that receives bounces and complaints:

What AgentMail provides:

TXT | mail | v=spf1 include:amazonses.com -all
MX  | mail | 10 feedback-smtp.us-east-1.amazonses.com   (EU domains: eu-central-1)

AgentMail sends through Amazon SES, so the record authorizes amazonses.com. The -all means mail for this hostname from any other server is unauthorized. Because mail.yourdomain.com is a subdomain of your From domain, SPF also passes DMARC’s default (relaxed) alignment.

Do not add AgentMail to the SPF record on your root domain. If your root domain already has SPF for another service (for example v=spf1 include:_spf.google.com ~all for Google Workspace), leave it exactly as it is. AgentMail’s SPF record lives on mail.yourdomain.com, a different hostname, so the two never conflict.

agentmail.to does not publish an SPF record, so an include:agentmail.to mechanism makes SPF evaluation end in a permanent error (permerror). If you added it while following an earlier version of this guide, remove it and keep the rest of your record unchanged.

The mail MX record must be the only MX record at mail.yourdomain.com. It handles bounce and complaint notifications, not incoming inbox mail.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email, proving it was sent by an authorized server and was not tampered with in transit. AgentMail uses a custom TXT record under a DKIM selector host so your domain publishes the exact key used for signing.

Legacy orgs should keep existing working DNS records in place. For new domain setup, add the TXT selector records shown in the AgentMail Console or API response.

What AgentMail provides:

TXT | selector._domainkey | v=DKIM1; k=rsa; p=(public key provided by AgentMail)

AgentMail provides the selector name and public key value for your domain. Once you add the TXT record, every email from your domain is signed with the matching private key. Publish exactly one TXT record at the selector host; remove any older record at the same name.

Use the exact selector host shown in the AgentMail Console or API response. Many DNS providers append your domain automatically, so you may need to enter only the selector._domainkey portion.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together. It tells receiving servers what to do when an email fails authentication: reject it, quarantine it (send to spam), or do nothing.

What AgentMail provides:

TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@agentmail.to

AgentMail sets the policy to reject by default, which means any email that fails DMARC authentication (typically when both SPF and DKIM fail to align with the sender domain) will be rejected outright. The rua tag sends aggregate reports to AgentMail so we can monitor your domain’s deliverability health.

A domain can have only one DMARC record. If _dmarc.yourdomain.com already has one, keep it instead of adding a second record. AgentMail verification accepts your existing record as long as it includes a rua=mailto: reporting address.

If you are setting up DMARC for the first time, consider starting with a less strict policy and graduating to reject:

Policy	Behavior	When to use
`p=none`	Monitor only, no action taken	Initial setup, while confirming everything works
`p=quarantine`	Failed emails go to spam	After confirming SPF and DKIM pass consistently
`p=reject`	Failed emails are rejected entirely	Production, once you trust your configuration

Do I need all three?

Yes. Each protocol serves a different purpose:

Protocol	What it proves
SPF	The sending server is authorized to send for your domain
DKIM	The email content has not been modified in transit
DMARC	What to do when SPF or DKIM fails, plus reporting

Without all three, your agent’s emails are more likely to land in spam or be rejected. Major providers like Gmail and Yahoo enforce these requirements.

How to set them up

Add your domain in the AgentMail Console or via the API
AgentMail provides the exact SPF, DKIM, DMARC, and MX records you need
Add those records at your DNS provider
Verify your domain in the console

The full record set

AgentMail returns the exact records for your domain in the AgentMail Console and in the records array of the Create Domain response. Always copy the values shown for your domain. For a US-region domain named example.com, the full set looks like this:

Purpose	Type	Name (host)	Value	Priority
Receiving	`MX`	`@`	`inbound-smtp.us-east-1.amazonaws.com`	`10`
Bounces (MAIL FROM)	`MX`	`mail`	`feedback-smtp.us-east-1.amazonses.com`	`10`
SPF (MAIL FROM)	`TXT`	`mail`	`v=spf1 include:amazonses.com -all`
DKIM	`TXT`	`<selector>._domainkey`	`v=DKIM1; k=rsa; p=...` (your public key)
DMARC	`TXT`	`_dmarc`	`v=DMARC1; p=reject; rua=mailto:dmarc@agentmail.to`

SPF lives on mail.example.com, not your root domain. AgentMail sends with a custom MAIL FROM subdomain, and SPF is checked against that hostname. Do not add anything to an existing SPF record on your root domain (for example one for Google Workspace or Microsoft 365).
The mail MX must be the only MX record at mail.example.com. If another MX record exists at that host, verification reports duplicate_records. This record carries bounces and complaints; it does not receive inbox mail.
DMARC needs a reporting address. If _dmarc.example.com already has a DMARC record, keep that single record instead of adding a second one, and make sure it includes a rua=mailto: tag.
DKIM needs exactly one TXT record at the selector host. Remove any older record at the same selector.
Send-only domains: create the domain with inbound_enabled set to false and the receiving MX is left out, so your existing provider keeps receiving mail.
Region: EU-region domains use eu-central-1 in the MX values in place of us-east-1.
Subdomains: names are relative to your DNS zone. For agents.example.com, the hosts become agents, mail.agents, _dmarc.agents, and <selector>._domainkey.agents.
Optional records: a link CNAME is added when tracking_enabled is on, and a wildcard * MX when subdomains_enabled is on.
Older domains may show three DKIM CNAME records (<token>._domainkey pointing to <token>.dkim.amazonses.com) instead of one DKIM TXT record. Keep them if they already verify.

For step-by-step DNS instructions, see our provider guides: Cloudflare, GoDaddy, Route 53, Namecheap.

For a deeper explanation of how these protocols work, see the SPF, DKIM, DMARC documentation.