Send e-mail from your own domain: SPF, DKIM and DMARC
The five DNS records, how to merge SPF and DMARC with the records you already have, how Monfri checks them and what to do when a record stays red.
You can send from the first day: every workspace has its own sender on a Monfri domain. To send as [email protected] — which mailbox providers trust more — add five DNS records at the company that hosts your domain's DNS.
Add your domain
Monfri adds the domain of your website for you when you set it up in the Hub. To add another one: in Push, open Email → Domains → Add Domain, type the domain (for example yourdomain.com) and click Add Domain. The two subdomains below the field — track and bounce — can stay as they are.
The five records
The setup guide in the Hub, step Sending, shows the exact values for your domain, ready to copy; so does the domain's page in Email → Domains.
| Type | Name | What it is for | |
|---|---|---|---|
| TXT | yourdomain.com |
SPF — says Monfri may send for your domain | required |
| TXT | krs1._domainkey.yourdomain.com (the exact name is on the page) |
DKIM — the signature that proves the e-mail is yours | required |
| TXT | _dmarc.yourdomain.com |
DMARC — what to do with mail that fails the checks, and where reports go | required |
| CNAME | bounce.yourdomain.com |
Return Path — bounces come back to Monfri, so bad addresses are removed | optional |
| CNAME | track.yourdomain.com |
Tracking — links and opens are counted on your own domain | optional |
Each record has Copy buttons for the name and the value. Most DNS providers want the short name — krs1._domainkey, not the full name; the page shows both.
Already have an SPF or a DMARC record?
A domain may have only one SPF record and only one DMARC record. If one exists — for example for Google Workspace or Microsoft 365 — do not add a second; edit the one you have. The domain's page notices it and shows ⚠ Existing DNS record detected with Your current record and the value to publish instead (✓ Publish this merged value instead). For SPF it looks like this:
v=spf1 include:_spf.google.com include:_spf.monfri.net ~all
Keep every include: you already had and a single ending (~all or -all). For DMARC, keep your own p= policy and rua= address if you rely on them; the domain still verifies.
How Monfri checks
- The domain becomes verified when SPF, DKIM and DMARC are found. Return Path and Tracking are not needed for that.
- After you add the records, click Verify DNS — or Auto-check (every 60s) and leave the page open. Monfri also checks on its own: after 1 minute, 5 minutes, 15 minutes, an hour, 6 hours and then daily, and every hour in the background.
- DNS changes take from a few minutes to a few hours, sometimes up to 24.
- A verified domain is not switched off by one failed check: it goes back to pending only after three failed checks in a row.
Until the domain is verified, keep sending from your Monfri address. Once it is, add a sender on it: Senders: who your e-mails come from.
Using Cloudflare?
Set the two CNAME records to DNS only (grey cloud). Proxied records point to Cloudflare instead of Monfri, and bounces and link tracking stop working.
If something doesn't work
Verification incomplete
The page lists what is still missing, record by record, with the reason the check found — for example that the record is not there yet, or that the value differs. Compare the record at your DNS provider with the value on the page, character by character.
SPF is red, though you added it
There are two SPF records now, or the include is in the wrong one. Merge them into one record, as above.
The domain was verified and is pending again
Three checks in a row did not find the required records. Someone may have changed the DNS — check that SPF, DKIM and DMARC are still there.
Sending domain is not verified. Re-verify DNS records before dispatching.
A campaign's sender is on a domain that is not verified. Fix the records, or pick a sender on a verified domain — see Senders.