Several email services on one domain: combine SPF and DKIM correctly

What it means

Most businesses send email from more than one place: a mailbox provider (Google Workspace, Microsoft 365), a newsletter tool, an online shop, a CRM, a billing tool or a website contact form. Each of them sends emails "From" your domain, so each one must be authorized and authenticated.

The rules are simple but often broken:

• SPF: your domain may have only one SPF record. All senders go into that single line.
• DKIM: each service gets its own key, stored under its own name (the selector). Keys never replace each other.
• DMARC: one record for the whole domain, which covers every service.

Why it matters

• When a second SPF record is added for a new tool, both records become invalid and SPF fails for every service.
• A service that is not authenticated with your domain fails DMARC, and its emails go to spam or are rejected once your policy is strict.
• Forgotten senders are the main reason people never dare to move DMARC to reject.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report.
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF, DMARC and MX records without sending anything.

Repeat the test once for each service that sends email for you.

How to fix it

1. Make an inventory. Write down every tool that sends email with your domain: mailbox, newsletters, shop, invoices, support desk, website. Check your DMARC reports to find ones you forgot.
2. Merge SPF into one line. Put every include: or ip4: after a single v=spf1 and end with one all:

   v=spf1 include:_spf.google.com include:spf.newsletter-example.com ip4:203.0.113.10 ~all

3. Watch the 10-lookup limit. Each include: counts as at least one DNS lookup, and SPF allows 10 in total. Remove services you no longer use. Some tools do not need an include at all once their custom return path is set up.
4. Add one DKIM record per service. Each tool gives you a selector name, for example:

   google._domainkey.yourdomain.com     TXT    (Google key)
   s1._domainkey.yourdomain.com         CNAME  (newsletter tool)
   shop._domainkey.yourdomain.com       CNAME  (online shop)

   If two tools ask for the same selector name, contact one of them: a name can hold only one key.
5. Verify in each tool. Click "Verify" or "Authenticate" in every service once the records are published.
6. Keep one DMARC record. Start with p=none and a reporting address, then tighten it once every service passes.

Tip: move heavy senders to a subdomain

If you have many tools, send newsletters from news.yourdomain.com. The subdomain has its own SPF record, which keeps your main SPF short.

Check that it is fixed

Run the Domain scanner: you should see exactly one valid SPF record and one DMARC record. Then send a test email from each service to a new Delivmail test address. Every report should show SPF or DKIM passing for your domain and DMARC passing. With Delivmail DMARC monitoring in the paid dashboard, any sender you missed will appear in the daily reports.