The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To set up DNS for SaaS email, publish the exact verification and authentication records supplied by your email provider, make sure SPF accounts for every system that sends from the domain, and configure DMARC so it aligns with the visible From address. First inventory your senders and identify the DNS provider that hosts the authoritative zone; changing outbound authentication records should not disrupt existing inbound mail routing.
Before changing DNS, identify the zone and every sender
Your registrar and DNS host may be different companies. Sign in to the service that manages the domain’s authoritative DNS zone, then list every system that sends email using the domain or its subdomains. Include mailbox hosting, transactional notifications, website forms, invoices, support tools, and marketing messages. Google specifically advises including third-party services when building an SPF policy: Google Workspace: Set up SPF.
As an Amazon Associate I earn from qualifying purchases.
Record the visible From domain and any separate return-path or MAIL FROM domain used by the SaaS provider. This distinction matters for DMARC: at least one of SPF or DKIM must both pass authentication and align with the domain shown in From.
What SPF, DKIM, and DMARC do
| Record or mechanism | Purpose | DNS role |
|---|---|---|
| SPF | Identifies which sending systems are authorized for a domain. | A TXT policy on the domain used for the SPF check. |
| DKIM | Lets receiving servers validate a message signature using a public key. | Typically a provider-specified TXT record or provider-managed CNAME. |
| DMARC | Connects SPF and DKIM results to the visible From domain through alignment, and sets a policy and reporting mechanism. | A TXT record at _dmarc.<domain>. |
These mechanisms complement one another; they are not interchangeable. For details on Google’s DKIM setup and key lengths, see Google Workspace: Set up DKIM. Amazon Web Services explains DMARC alignment and policy in its Amazon SES DMARC documentation.
#1 Best Overall
Publish the SaaS provider’s exact records
There is no universal DNS record set for SaaS email. Use the record name, type, and value shown in the selected service’s current setup console; records from another provider’s instructions are not substitutes. A provider may require TXT records for verification or DKIM, CNAME records that point to provider-managed authentication infrastructure, or records for a separate sending domain.
For example, Twilio SendGrid’s domain-authentication process generates provider-specific records, including a CNAME for its branded domain setup. Its instructions are at Twilio SendGrid: Set up domain authentication. Google describes DKIM as a public/private key arrangement: the sending system signs with the private key, while the public key is published in DNS. Google recommends a 2048-bit key where supported; its guidance says personal Gmail delivery requires at least 1024 bits.
Rank #2
Build one coordinated SPF policy
For each domain or subdomain used to send mail, maintain one SPF TXT policy that includes all current senders according to their documentation. If you already have SPF, update that policy rather than adding a second SPF record. Multiple SPF policies for the same domain can cause SPF evaluation to fail.
Google’s example for a domain sending only through Google Workspace is v=spf1 include:_spf.google.com ~all. It is only an example for that configuration; do not copy it unchanged if a SaaS service, website, or other system also sends from the domain. Google recommends ~all in its guidance and advises removing authorizations for senders or IP addresses no longer in use.
Rank #3
Google’s SPF guidance allows a maximum of 10 include: tags. If many services send mail, review the complete SPF lookup behavior rather than adding authorizations indefinitely. The guidance and example are in Google’s SPF setup instructions.
Add DMARC in monitoring mode before enforcement
Create a TXT record named _dmarc at the domain you intend to monitor. DMARC evaluates whether the authenticated SPF domain or DKIM signing domain aligns with the visible From domain. A message can pass SPF or DKIM without passing DMARC if the authenticated domain does not align.
For a new setup or one with unknown senders, begin with a monitoring policy such as p=none and review aggregate reports to find legitimate services that are not yet authenticated. AWS recommends a gradual rollout before moving to enforcement. Its documentation includes an example with p=quarantine and a reporting destination, but the right policy depends on the domain’s actual traffic; do not jump to enforcement before you understand that traffic. See AWS’s DMARC guidance.
Keep inbound MX routing separate
MX records determine where incoming email for a domain is routed. Do not replace existing MX values simply because an outbound SaaS service asks you to authenticate email. Check what domain the requested record applies to and what function it serves before making a change.
Some services require an MX record for a dedicated return-path domain. For Amazon SES custom MAIL FROM, the MAIL FROM domain must be a subdomain of a verified identity’s parent domain and should not also be used for ordinary sending or receiving. SES requires an MX and SPF TXT record on that selected subdomain; this is distinct from replacing the organization’s ordinary inbound-mail MX records. See Amazon SES: Using a custom MAIL FROM domain and Amazon SES MAIL FROM MX requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the records and test a message
- Publish the records. Enter each provider-issued record at the DNS host, preserving its type, name, and value. Be alert to DNS interfaces that append the domain name automatically to a record name.
- Use the SaaS console’s verification controls. Wait for the provider to detect the records. Google says SPF can take up to 48 hours to start working after publication; other records and provider checks depend on DNS propagation and the provider’s verification process.
- Send a test message and inspect its full headers. Check that SPF and DKIM pass, then confirm that at least one passing mechanism aligns with the visible From domain for DMARC.
- Review DMARC reports before tightening policy. Identify legitimate senders that are missing or misconfigured, update their authentication, and only then consider a stricter policy.
- Document ownership and purpose. Note who owns each DNS entry, what service depends on it, and when it can be retired. Remove an old sender authorization only after confirming that service no longer sends for the domain.
Gmail sender requirements and deliverability
Google’s Gmail guidance, effective February 1, 2024, says all senders to Gmail accounts must configure SPF or DKIM and meet other requirements, including valid forward and reverse DNS for sending IPs and TLS in transit. Senders exceeding 5,000 messages per day to Gmail accounts must configure SPF, DKIM, and DMARC. For direct mail, the visible From domain must align with either the SPF domain or the DKIM domain. These are requirements for delivery to Gmail accounts, not a universal rule for every mailbox provider. Check Google’s current Email sender guidelines for current policy details.
Google’s same guidance says bulk senders should keep the spam rate reported in Postmaster Tools below 0.30%; marketing or subscribed messages must support one-click unsubscribe and include a visible unsubscribe link. Authentication improves the integrity of sender identification and is required for some Gmail senders, but it does not guarantee inbox placement or prevent spam filtering.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
