MailerLite: DKIM and SPF setup

Before you start

MailerLite requires domain authentication when you send from your own domain. New accounts can send their first campaigns without it only during the 14-day trial. MailerLite's pages do not name a user role or a plan that authentication needs.

You also need access to the DNS settings of example.com, wherever they are managed. That may be your website provider or hosting service rather than the company where you bought the domain.

Turn on DKIM

MailerLite asks for three records: DKIM as a CNAME record, SPF as a TXT record, and a domain verification TXT record. The records cannot be changed inside MailerLite, so enter them exactly as shown.

1. Go to the Account settings page and select the Domains tab.
2. Click Add domain, enter the address you send from at example.com, and click Save.
3. Click Continue. MailerLite detects your DNS host and offers to connect to it. To add the records yourself, choose Or manually authenticate your domain.
4. Select your DNS host, or Other, and click Continue. MailerLite shows the Name and Value of each record. Keep the page open.
5. At your DNS host, add the DKIM CNAME record. Its name is litesrv._domainkey. If your DNS host adds the domain to values, end the value with a dot, as in litesrv._domainkey.mlsend.com.
6. Add the SPF and domain verification TXT records, as described in SPF.
7. Back on the Domains tab, click Authenticate next to example.com, then Check DNS Records.

MailerLite says it can take up to 24 hours for the records to be approved, and most are approved within minutes.

Sign with your own domain

Reports show MailerLite mail signed by one of MailerLite's domains, which does not align with example.com. Authenticate example.com as in Turn on DKIM. With the DKIM record under example.com, DKIM can align.

Check the DKIM key

If MailerLite does not approve the DKIM record:

1. Check that it is a CNAME record, not a TXT record.
2. Check that its name is litesrv._domainkey. Most DNS hosts add example.com to the name themselves.
3. If your DNS host adds the domain to the value, put a dot at the end of the value.
4. Compare the record with the one MailerLite shows. It must match exactly.

SPF

MailerLite's SPF record goes on example.com itself. Leave the Name field empty or enter @, as your DNS host expects. MailerLite's SPF value includes include:_spf.mlsend.com, and the record must match the one on your Domains page exactly.

A domain may have only one SPF record. When you click Check DNS Records, MailerLite updates the SPF value it shows into a merged one. MailerLite's example of a merged record:

v=spf1 a mx include:_spf.mlsend.com include:spf.protection.outlook.com -all

Delete the old SPF records, including the unmerged MailerLite one, and add the merged value as a single TXT record. MailerLite also notes the limits: 255 characters per SPF string and 10 DNS lookups.

The domain verification record also goes on example.com itself, with the Name left empty, @, or the domain name, depending on your DNS host.

Check it worked

1. On the Domains tab, click Check DNS Records. When the DKIM and SPF records match, MailerLite approves them and example.com is authenticated.
2. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for MailerLite. The DKIM table on Mailmoni's DNS tab lists the litesrv selector once a report includes it.

MailerLite's pages: Domain authentication and Troubleshooting domain authentication.