> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://www.agentmail.to/docs/llms.txt.

# How do I set up SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three email authentication protocols that prove your emails are legitimate. They are essential for deliverability: Gmail, Outlook, and other major providers now require all three for reliable inbox placement.

AgentMail provides all three records automatically when you add a custom domain. You just need to add them to your DNS provider.

## SPF (Sender Policy Framework)

SPF tells receiving servers which mail servers are authorized to send email for a domain. Receivers check SPF against the envelope sender (the Return-Path, also called MAIL FROM), which can be a different hostname from the address in the visible From header.

AgentMail sends from a dedicated MAIL FROM subdomain, `mail.yourdomain.com`. The SPF record goes on that subdomain, together with an MX record that receives bounces and complaints:

**What AgentMail provides:**

```text
TXT | mail | v=spf1 include:amazonses.com -all
MX  | mail | 10 feedback-smtp.us-east-1.amazonses.com   (EU domains: eu-central-1)
```

AgentMail sends through Amazon SES, so the record authorizes `amazonses.com`. The `-all` means mail for this hostname from any other server is unauthorized. Because `mail.yourdomain.com` is a subdomain of your From domain, SPF also passes DMARC's default (relaxed) alignment.

> **Warning**
>
> Do **not** add AgentMail to the SPF record on your root domain. If your root domain already has SPF for another service (for example `v=spf1 include:_spf.google.com ~all` for Google Workspace), leave it exactly as it is. AgentMail's SPF record lives on `mail.yourdomain.com`, a different hostname, so the two never conflict.
>
> `agentmail.to` does not publish an SPF record, so an `include:agentmail.to` mechanism makes SPF evaluation end in a permanent error (`permerror`). If you added it while following an earlier version of this guide, remove it and keep the rest of your record unchanged.

> **Note**
>
> The `mail` MX record must be the only MX record at `mail.yourdomain.com`. It handles bounce and complaint notifications, not incoming inbox mail.

## DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email, proving it was sent by an authorized server and was not tampered with in transit. AgentMail uses a custom TXT record under a DKIM selector host so your domain publishes the exact key used for signing.

> **Note**
>
> Legacy orgs should keep existing working DNS records in place. For new domain setup, add the TXT selector records shown in the AgentMail Console or API response.

**What AgentMail provides:**

```text
TXT | selector._domainkey | v=DKIM1; k=rsa; p=(public key provided by AgentMail)
```

AgentMail provides the selector name and public key value for your domain. Once you add the TXT record, every email from your domain is signed with the matching private key. Publish exactly one TXT record at the selector host; remove any older record at the same name.

> **Note**
>
> Use the exact selector host shown in the AgentMail Console or API response. Many DNS providers append your domain automatically, so you may need to enter only the `selector._domainkey` portion.

## DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together. It tells receiving servers what to do when an email fails authentication: reject it, quarantine it (send to spam), or do nothing.

**What AgentMail provides:**

```text
TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@agentmail.to
```

AgentMail sets the policy to `reject` by default, which means any email that fails DMARC authentication (typically when both SPF and DKIM fail to align with the sender domain) will be rejected outright. The `rua` tag sends aggregate reports to AgentMail so we can monitor your domain's deliverability health.

> **Note**
>
> A domain can have only one DMARC record. If `_dmarc.yourdomain.com` already has one, keep it instead of adding a second record. AgentMail verification accepts your existing record as long as it includes a `rua=mailto:` reporting address.

**If you are setting up DMARC for the first time,** consider starting with a less strict policy and graduating to `reject`:

| Policy         | Behavior                            | When to use                                      |
| -------------- | ----------------------------------- | ------------------------------------------------ |
| `p=none`       | Monitor only, no action taken       | Initial setup, while confirming everything works |
| `p=quarantine` | Failed emails go to spam            | After confirming SPF and DKIM pass consistently  |
| `p=reject`     | Failed emails are rejected entirely | Production, once you trust your configuration    |

## Do I need all three?

Yes. Each protocol serves a different purpose:

| Protocol | What it proves                                           |
| -------- | -------------------------------------------------------- |
| SPF      | The sending server is authorized to send for your domain |
| DKIM     | The email content has not been modified in transit       |
| DMARC    | What to do when SPF or DKIM fails, plus reporting        |

Without all three, your agent's emails are more likely to land in spam or be rejected. Major providers like Gmail and Yahoo enforce these requirements.

## How to set them up

1. Add your domain in the [AgentMail Console](https://console.agentmail.to) or via the API
2. AgentMail provides the exact SPF, DKIM, DMARC, and MX records you need
3. Add those records at your DNS provider
4. Verify your domain in the console

### The full record set

AgentMail returns the exact records for your domain in the [AgentMail Console](https://console.agentmail.to) and in the `records` array of the [Create Domain](https://docs.agentmail.to/api-reference/domains/create) response. Always copy the values shown for your domain. For a US-region domain named `example.com`, the full set looks like this:

| Purpose             | Type  | Name (host)             | Value                                               | Priority |
| ------------------- | ----- | ----------------------- | --------------------------------------------------- | -------- |
| Receiving           | `MX`  | `@`                     | `inbound-smtp.us-east-1.amazonaws.com`              | `10`     |
| Bounces (MAIL FROM) | `MX`  | `mail`                  | `feedback-smtp.us-east-1.amazonses.com`             | `10`     |
| SPF (MAIL FROM)     | `TXT` | `mail`                  | `v=spf1 include:amazonses.com -all`                 |          |
| DKIM                | `TXT` | `<selector>._domainkey` | `v=DKIM1; k=rsa; p=...` (your public key)           |          |
| DMARC               | `TXT` | `_dmarc`                | `v=DMARC1; p=reject; rua=mailto:dmarc@agentmail.to` |          |

* **SPF lives on `mail.example.com`, not your root domain.** AgentMail sends with a custom MAIL FROM subdomain, and SPF is checked against that hostname. Do not add anything to an existing SPF record on your root domain (for example one for Google Workspace or Microsoft 365).
* **The `mail` MX must be the only MX record at `mail.example.com`.** If another MX record exists at that host, verification reports `duplicate_records`. This record carries bounces and complaints; it does not receive inbox mail.
* **DMARC needs a reporting address.** If `_dmarc.example.com` already has a DMARC record, keep that single record instead of adding a second one, and make sure it includes a `rua=mailto:` tag.
* **DKIM needs exactly one TXT record at the selector host.** Remove any older record at the same selector.
* **Send-only domains:** create the domain with `inbound_enabled` set to `false` and the receiving MX is left out, so your existing provider keeps receiving mail.
* **Region:** EU-region domains use `eu-central-1` in the MX values in place of `us-east-1`.
* **Subdomains:** names are relative to your DNS zone. For `agents.example.com`, the hosts become `agents`, `mail.agents`, `_dmarc.agents`, and `<selector>._domainkey.agents`.
* **Optional records:** a `link` CNAME is added when `tracking_enabled` is on, and a wildcard `*` MX when `subdomains_enabled` is on.
* **Older domains** may show three DKIM `CNAME` records (`<token>._domainkey` pointing to `<token>.dkim.amazonses.com`) instead of one DKIM TXT record. Keep them if they already verify.

For step-by-step DNS instructions, see our provider guides: [Cloudflare](/knowledge-base/dns-cloudflare), [GoDaddy](/knowledge-base/dns-godaddy), [Route 53](/knowledge-base/dns-route53), [Namecheap](/knowledge-base/dns-namecheap).

For a deeper explanation of how these protocols work, see the [SPF, DKIM, DMARC](/email-protocols) documentation.