Domain Setup: SPF, DKIM and DMARC Records

Add and verify your sending domain in AhaSend: publish the SPF, DKIM (CNAME), DMARC, return-path and tracking DNS records, then run the DNS check.

To send email with AhaSend, add your domain, publish its SPF, DKIM and DMARC records, then run the DNS check; this guide walks through each step.

Free includes 3 sending domains; Pro and Max include unlimited domains. Automatic DKIM rotation is available on all three plans. Custom DKIM selectors and bring-your-own DKIM are Platform Partner features. See plans and features.

Domain verification is required before you can send any emails through AhaSend. Unverified domains cannot send emails and will result in API errors.

Which DNS records do I need?

Publish the records shown for your domain in the dashboard. New managed-DNS domains use these record types:

Record	Type	Purpose	Required for sending?
SPF	TXT	Authorizes AhaSend through include:spf.ahasend.com	Yes
DKIM	Two CNAMEs	Active and standby signing keys	Yes; publish both for rotation
DMARC	TXT	Sets your domain’s authentication policy	Yes
Return-path	CNAME	Handles bounces and supports SPF alignment	Recommended
Tracking	CNAME	Uses your domain for tracking links	When tracking is used
MX	Dashboard values	Receives inbound email for routing	When inbound routing is used

Copy the exact hostnames and values from your domain page; manual DNS and whitelabel setups can differ.

Why does AhaSend need DNS records?

Email receivers use multiple authentication methods to verify that emails are legitimate. When you properly configure your domain with AhaSend, you’re telling receiving servers that:

1. You own the domain and have the rights to send emails from it
2. You’ve authorized AhaSend to send emails on behalf of your domain
3. Your emails are authentic and not spoofed or malicious

Without proper domain setup, your emails will either be rejected outright or land in spam folders, significantly impacting your delivery rates.

Subdomain recommendation: Use a subdomain like email.yourcompany.com instead of your main domain for transactional emails. This separates configuration and monitoring; mailbox providers can still consider the parent domain’s reputation. See sending subdomains.

Prerequisites

Before setting up your domain, make sure you have:

• Access to your DNS provider (usually your hosting provider or domain registrar)
• An AhaSend account with verified email address
• The domain or subdomain you want to use for sending emails

Managed DNS vs manual DNS: New domains in AhaSend use managed DNS (DNS v3) by default. Managed DNS shows two DKIM CNAME records so AhaSend can rotate DKIM keys safely over time. Some older or explicitly manual domains may still use the legacy single-DKIM-TXT setup instead. Your domain details page is always the source of truth for the exact records you need to publish.

1. Add your domain

   Start by adding your domain to your AhaSend account:

   1. Log in to your AhaSend Dashboard
   2. Navigate to Domains in the sidebar
   3. Click “Add Domain”
   4. Enter your domain name (e.g., email.yourcompany.com)
   5. Click “Create Domain”

   You’ll be redirected to the domain details page where you can see all required DNS records.

   API Alternative: You can also add domains programmatically using our Domains API.

2. Configure DNS records

   Add the DNS records shown on your domain details page. The exact hostnames and values can vary by account, domain mode, and reseller configuration.

   Required for sending: SPF, DKIM, and DMARC must be valid before the domain can send mail.

   Optional or feature-specific: Return-path, tracking, subscription management, media, and MX records improve deliverability or enable product features, but they are not all required for basic sending.

   Custom subdomains: AhaSend can use custom subdomains for return-path, tracking, subscription management, and media. Always copy the exact hostnames from your domain page instead of assuming the defaults.

   SPF record (Required)

   Sender Policy Framework (SPF) authorizes AhaSend to send emails on your domain’s behalf.

   Record Type: TXT Purpose: Prevents email spoofing by specifying authorized sending servers

   Name: @ (or your subdomain)
   Type: TXT
   Value: v=spf1 include:spf.ahasend.com ~all
   

   If you already have an SPF record, do not create a duplicate. Instead, add include:spf.ahasend.com to your existing SPF record before the final mechanism (~all or -all).

   AhaSend can validate SPF through the return-path setup in some cases, but you should still publish the SPF record shown in your dashboard. It is the most portable and least surprising setup.

   DKIM records (Required)

   DomainKeys Identified Mail (DKIM) cryptographically signs your emails to verify authenticity.

   Record Type: Usually CNAME for managed DNS, sometimes TXT for manual DNS Purpose: Prevents email tampering, confirms sender identity, and enables safe DKIM rotation on managed domains

   Managed DNS (DNS v3):

   Name: managed._domainkey.(your domain or subdomain)
   Type: CNAME
   Value: [AhaSend alias shown in dashboard]
   
   Name: managed2._domainkey.(your domain or subdomain)
   Type: CNAME
   Value: [AhaSend alias shown in dashboard]
   

   Managed DNS domains show two DKIM selectors: one active selector used for signing now, and one standby selector used for future rotation. Your domain can verify with the active selector alone, but publishing both DKIM CNAMEs up front is recommended so future DKIM rotation does not require another DNS change.

   Manual DNS:

   Name: [selector]._domainkey.(your domain or subdomain)
   Type: TXT
   Value: [unique DKIM public key]
   

   If you are working with a legacy or explicitly manual domain, your dashboard will show a single DKIM TXT record instead of the managed CNAME-based setup.

   DMARC record (Required)

   Domain-based Message Authentication, Reporting and Conformance (DMARC) provides policy guidance for email authentication failures.

   Record Type: TXT Purpose: Protects your domain from email spoofing and phishing attacks

   Name: _dmarc
   Type: TXT
   Value: v=DMARC1; p=quarantine; sp=none; adkim=r; aspf=r;
   

   This DMARC policy asks receiving servers to quarantine messages that fail DMARC. It has no rua tag and sends no aggregate reports. You can add your own rua=mailto:[e-mail] address to receive reports. If the domain already has a DMARC record, update that record instead of adding another. Check all services that send from the domain before enforcing a quarantine policy.

   Subdomains inherit the root record. If you add mail.example.com, the DNS check first looks for _dmarc.mail.example.com. If there is none, it looks for _dmarc.example.com and accepts that. You only need a DMARC record on the subdomain itself when you want a different policy or reporting address for it.

   Return-Path record (Highly recommended)

   Return-Path specifies where bounce messages and delivery notifications should be sent.

   Record Type: CNAME Purpose: Improves deliverability by providing a communication channel for bounce handling and SPF alignment

   Name: [return-path subdomain].(your domain or subdomain)
   Type: CNAME
   Value: [value shown in dashboard]
   

   While not strictly required for every setup, the return-path record is strongly recommended. It improves bounce handling and is part of the managed DNS flow for many domains.

   Email tracking record (Optional)

   Tracking Domain ensures tracking URLs in your emails come from your domain instead of AhaSend’s.

   Record Type: CNAME Purpose: Improves deliverability and maintains brand consistency for tracked links

   Name: [tracking subdomain].(your domain or subdomain)
   Type: CNAME
   Value: [value shown in dashboard]
   

   Email tracking is disabled by default and must be explicitly enabled in your account settings, even if you configure the tracking domain.

   Subscription management record (Optional)

   Subscription management domain hosts unsubscribe and subscription management links on your own domain.

   Record Type: CNAME Purpose: Keeps subscription management links branded on your domain

   Name: [subscription subdomain].(your domain or subdomain)
   Type: CNAME
   Value: [value shown in dashboard]
   

   This record is optional, but recommended if you want subscription management URLs to use your own domain instead of an AhaSend hostname.

   Media record (Optional)

   Media domain serves hosted media assets from your own domain.

   Record Type: CNAME Purpose: Keeps hosted assets and media URLs branded on your domain

   Name: [media subdomain].(your domain or subdomain)
   Type: CNAME
   Value: [value shown in dashboard]
   

   This record is optional and mainly useful if you use AhaSend-hosted assets or want a consistent branded media hostname.

   MX record (Recommended)

   Mail Exchanger (MX) specifies the mail server responsible for receiving emails for your domain.

   Record Type: MX Purpose: Required for receiving emails, recommended for better sending reputation

   Name: @ (or your subdomain)
   Type: MX
   Priority: 10
   Value: [value shown in dashboard]
   

   While not required for sending emails, some receiving servers penalize domains without MX records. Adding this record improves overall deliverability.

3. Wait for DNS propagation

   DNS changes can take time to propagate across the internet:

   • Typical time: 5-30 minutes
   • Maximum time: Up to 48 hours
   • Check status: Use online DNS checkers to verify your records are live

   Pro tip: Use tools like DNS Checker or What’s My DNS to verify your records have propagated globally.

4. Verify your domain

   Once your DNS records are live, verify your domain in AhaSend:

   1. Return to your domain details page in the dashboard
   2. Click “Check DNS” to run verification
   3. Wait for confirmation - this usually takes just a few seconds
   4. Look for the green checkmarks next to each record type

   Success! When SPF, DKIM, and DMARC show as valid, your domain is ready to send emails.

   On managed DNS domains, you may see a second DKIM selector that is marked as standby or not currently required. That is expected. Publishing it anyway is recommended so DKIM rotation can happen without a future DNS update.

   If verification fails, double-check that:

   • All DNS records are added exactly as shown
   • DNS changes have had time to propagate
   • You don’t have conflicting DNS records
   • You didn’t create a second SPF TXT record
   • You published the DKIM record type shown by AhaSend (CNAME for managed DNS, TXT for manual DNS)

DNS provider guides

Choose your authoritative DNS provider for record names and setup steps.

Cloudflare

GoDaddy

Namecheap

Route 53

Hetzner

IONOS

STRATO

TransIP

OVHcloud

Squarespace

Vercel

How do I manage domains through the API?

For programmatic domain management, use our comprehensive Domains API:

Create domain

Add new domains programmatically

List domains

Retrieve all your configured domains

Get domain details

Check domain verification status

Delete domain

Remove domains from your account

API v2 also supports updating domain DNS settings such as tracking, return-path, subscription, media, and DKIM rotation interval, as well as requesting a DNS check for an existing domain.

Why is my domain not verified?

Most records verify within minutes. DNS changes can take up to 48 hours to propagate. After a domain is added or verified, allow up to 2 minutes for the SMTP configuration to refresh if you see 556 Invalid account or domain.

DNS records not verifying

Common causes and solutions:

• Wait longer: DNS propagation can take up to 48 hours
• Check record values: Ensure exact copy-paste from dashboard (no extra spaces)
• Verify record type: SPF and DMARC use TXT; DKIM can be CNAME or TXT depending on your domain mode
• Remove duplicates: Don’t create multiple SPF records
• Check with DNS tools: Use online DNS checkers to verify records are live

Existing SPF record conflicts

If you already have an SPF record:

1. Don’t create a duplicate - domains can only have one SPF record
2. Modify your existing record by adding include:spf.ahasend.com
3. Place it before the final mechanism (~all or -all)

Example:

OLD: v=spf1 include:_spf.google.com ~all
NEW: v=spf1 include:_spf.google.com include:spf.ahasend.com ~all

Why do I see two DKIM records?

Managed DNS domains use two DKIM selectors.

• Active selector: Used for signing mail right now and required for verification
• Standby selector: Reserved for the next DKIM rotation

Publishing both DKIM CNAMEs from the start is recommended. It lets AhaSend rotate keys later without requiring another DNS change on your side.

Subdomain vs root domain

Understanding the difference:

• Root domain: yourcompany.com (affects all subdomains)
• Subdomain: email.yourcompany.com (isolated setup)

For subdomains: Add the SPF, DKIM, return-path and tracking records at the subdomain itself. DMARC is the exception: a record at the root domain also counts, because the DNS check falls back to _dmarc.<root domain> when the subdomain has none.

Records like return-path, tracking, subscription management, and media are usually additional subdomains under the domain you add to AhaSend.

Still having issues?

We’re here to help:

• Check our status page for any ongoing DNS issues
• Contact support at [e-mail]
• Include your domain name and specific error messages
• Attach screenshots of your DNS configuration if helpful

Our engineering team typically responds within a few hours!

What’s next?

Once your domain is verified, you’re ready to start sending emails:

Send your first email

Follow our quickstart guide to send emails via API or SMTP

Create SMTP credentials

Generate credentials for your applications

Create API keys

Track email delivery and engagement events

Enable tracking

Monitor opens and clicks on your emails

Domain setup complete? Your domain is now ready to send emails through AhaSend. Test it out with our quickstart guide to send your first email!

Common domain questions

Can I keep my existing SPF record?

Yes. Add include:spf.ahasend.com to the existing SPF record before its final ~all or -all mechanism. Do not publish a second SPF record.

Why are there two DKIM records?

Managed DNS uses one active key and one standby key so AhaSend can rotate signing keys. Publish both CNAMEs shown in your dashboard.

How long does verification take?

Most records verify within minutes. DNS changes can take up to 48 hours to propagate. Check the DNS host, type and value if verification still fails.

Should I use a subdomain?

Use a dedicated subdomain when you want to separate transactional sending from other mail on your main domain. Add and verify that subdomain in AhaSend.

Domain, Delivery and Migration Guides

• DNS provider guides: record names and setup steps for Cloudflare, GoDaddy, Namecheap, Route 53, Hetzner, IONOS, STRATO, TransIP, OVHcloud, Squarespace and Vercel.
• SPF, DKIM and DMARC: what each check proves and how domain alignment works.
• Bounces and suppressions and SMTP error codes: understand a failed send and choose the next step.
• Deliverability best practices: sender reputation, warm-up, sending subdomains, Gmail and Yahoo requirements, and one-click unsubscribe.
• Migrate from SendGrid, Mailgun, Postmark, Resend or Amazon SES, including suppression imports.
• Troubleshooting and FAQ: domain checks, missing messages, port 465, permission errors and blocked recipients.
• Email glossary and credential security: definitions and practical steps to protect your account.

Related guides

• Account quickstart, Domain API, Domain CLI.
• DNS whitelabel, Send-only API keys, Inbound MX setup.
• Plans and limits, Tracking setup.