--- title: "SpamHero SPF & DKIM Configuration: The Complete Guide from AutoSPF" description: "At AutoSPF, we know that email authentication isn’t an optional add-on - it’s a foundational requirement for any business that wants reliable inbox." image: "https://autospf.com/og/blog/spamhero-spf-dkim-configuration-the-complete-guide-from-autospf.png" canonical: "https://autospf.com/blog/spamhero-spf-dkim-configuration-the-complete-guide-from-autospf/" --- Quick Answer At AutoSPF, we know that email authentication isn’t an optional add-on - it’s a foundational requirement for any business that wants reliable inbox delivery and protection from fraud, spoofing, and malicious impersonation. When you’re using an email security service like SpamHero, proper setup of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records is essential to ensure that your. ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fspamhero-spf-dkim-configuration-the-complete-guide-from-autospf%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=SpamHero%20SPF%20%26%20DKIM%20Configuration%3A%20The%20Complete%20Guide%20from%20AutoSPF&url=https%3A%2F%2Fautospf.com%2Fblog%2Fspamhero-spf-dkim-configuration-the-complete-guide-from-autospf%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fspamhero-spf-dkim-configuration-the-complete-guide-from-autospf%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fspamhero-spf-dkim-configuration-the-complete-guide-from-autospf%2F&title=SpamHero%20SPF%20%26%20DKIM%20Configuration%3A%20The%20Complete%20Guide%20from%20AutoSPF "Share on Reddit") [ ](mailto:?subject=SpamHero%20SPF%20%26%20DKIM%20Configuration%3A%20The%20Complete%20Guide%20from%20AutoSPF&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fspamhero-spf-dkim-configuration-the-complete-guide-from-autospf%2F "Share via Email") ![SpamHero SPF & DKIM Configuration](https://media.mailhop.org/autospf/images/2026/01/spf-lookup-4112.jpg) At [AutoSPF](/), we know that email authentication isn’t an optional add-on - it’s a foundational requirement for any business that wants reliable inbox delivery and protection from fraud, spoofing, and malicious impersonation. When you’re using an email security service like SpamHero, proper setup of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records is essential to ensure that your legitimate mail streams are trusted by recipient [mail servers](https://www.activecampaign.com/glossary/mail-server), pass modern authentication checks, and don’t get erroneously flagged as spam. _DKIM ([RFC 6376](https://datatracker.ietf.org/doc/html/rfc6376)) signs email messages cryptographically, and unlike SPF, the signature survives email forwarding - which is why DMARC alignment via DKIM is more reliable than SPF alignment for forwarded mail and mailing lists._ In this guide, we’re going to walk you through everything you need to know to configure SPF and DKIM for SpamHero - and why these records matter - from an _AutoSPF perspective_. _By the end, you’ll understand both how to implement these records and why they’re essential for effective email authentication_. ## Why Email Authentication Matters Before we jump into step-by-step configuration, let’s make sure the “why” is clear. Modern mail systems like Gmail, Yahoo, Outlook, and others don’t just trust that an email _claims_ to be from your domain - they _verify_ using authentication protocols like SPF, DKIM, and DMARC. These protocols help receiving servers determine: - That the sending source is actually authorized by you, - _That the message hasn’t been tampered with in transit_, - And that the sender’s domain isn’t being spoofed for phishing or [spam attacks](https://www.scworld.com/brief/fbi-us-officials-spoofed-in-ongoing-voice-sms-phishing-campaign). Without proper SPF and DKIM records in DNS, even legitimate messages sent through trusted platforms like SpamHero can be delayed, marked as spam, or rejected outright. ![Email authentication](https://media.mailhop.org/autospf/images/2026/01/how-to-create-spf-record-0331.jpg) At its core: - SPF specifies which servers are allowed to send email on behalf of your domain. - DKIM uses [cryptographic signatures](https://learn.microsoft.com/en-us/dotnet/standard/security/cryptographic-signatures) to verify that the content of your message hasn’t been altered and that it was legitimately sent by your sending domain. _The combination of these mechanisms signals to receiving mail servers and anti-spam systems that your emails are authentic - which improves inbox placement and protects your brand reputation_. ## SpamHero & Email Authentication: What You Need to Know SpamHero is a powerful email security and outbound mail management platform, widely used for filtering inbound spam as well as handling outbound mail. But simply signing up for SpamHero isn’t enough - if your SPF and DKIM records aren’t configured correctly, SPF will fail and your mail can land in [spam folders](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/). According to documentation from EasyDMARC, SpamHero _currently does not support DKIM for outbound mail_, which means _SPF is the primary authentication protocol you can use for SpamHero and DMARC checks will rely on SPF passing successfully_. That makes setting up your SPF record correctly even more critical. ## Step-by-Step: Configuring SPF for SpamHero Let’s start with SPF, because this is the record SpamHero _does_ rely on. ### 1\. Access Your DNS Provider Log into the control panel of the registrar or [DNS hosting service](https://technumero.com/free-dns-hosting-services/) that manages your domain’s DNS zone file. _This might be services like Cloudflare, GoDaddy, AWS Route 53, or similar_. Find your [DNS zone](https://www.ibm.com/think/topics/dns-zone) management page - this is where TXT records, A records, MX records, and SPF records are managed. ### 2\. Create or Update the SPF TXT Record You need a single TXT record for SPF per domain (only one is allowed - more than one will cause SPF to break). If you don’t already have an [SPF record](/blog/spf-records-in-dns-a-complete-guide-for-email-security/), you’ll create a new one. If you already have one, you’ll need to merge SpamHero into it (more on that below). Here’s the SPF value you will use for SpamHero: ``` v=spf1 include:spf.spamhero.com ~all ``` _This tells the world’s mail servers that SpamHero’s mail sending infrastructure is authorized to send on behalf of your domain_. ![Email authentication](https://media.mailhop.org/autospf/images/2026/01/kitterman-spf-2341.jpg) Steps: 1. Click “Add TXT Record” in your DNS dashboard. 2. In the Name/Host field, enter your domain or use “@” to represent the root domain. 3. In the Value or TXT Data field, enter: ``` v=spf1 include:spf.spamhero.com ~all ``` 1. Save the record. ### 3\. Merge with Existing SPF Records (If Needed) Domains commonly already have SPF records from other email services - like Google Workspace, Microsoft 365, [CRM platforms](https://crm.io/what-is-a-crm-platform), marketing automation tools, etc. However, DNS only allows one SPF TXT record per domain. If you already have an SPF record, you need to _merge_ the SpamHero include into it - otherwise DNS will return a “PermError” and SPF won’t work at all. Example: Old Record ``` v=spf1 include:_spf.google.com ~all ``` Merged Record ``` v=spf1 include:_spf.google.com include:spf.spamhero.com ~all ``` _Make sure all your email sources are included before the final \~all (which means “soft fail anything not listed here”)_. A good practice is to work with tools that can validate merged SPF values; AutoSPF provides automated merging so you don’t accidentally exceed DNS lookup limits or introduce syntax errors. ### 4\. Wait for DNS Propagation DNS changes don’t take effect instantly. In most cases, it can take up to 72 hours for the new SPF record to fully propagate across the global DNS network. During this time, some mail servers will immediately start checking against the new record, while others will continue using [cached DNS data](https://www.cloudns.net/blog/dns-cache-explained/). ### 5\. Validate Your SPF Record _Once the DNS changes have had time to propagate, use SPF validation tools (such as AutoSPF’s SPF analyzer) to confirm_: - The record is syntactically correct, - Your domain has only one SPF record, - And that SpamHero is correctly included. This helps ensure that email receivers will use the correct SPF policy for authentication checks. ![Email spam](https://media.mailhop.org/autospf/images/2026/01/spf-checker-2330.jpg) ## What About DKIM with SpamHero? Now let’s talk about DKIM. According to documentation, SpamHero does not currently support DKIM signing for outbound mail directly, which means one of two things: 1. If SpamHero did support DKIM signing, you would generate DKIM keys and publish a public key as a DNS TXT (or CNAME) record pointing to the key. 2. But in this case, you’ll rely largely on SPF for DMARC alignment - which is fine _if SPF passes and aligns with your domain_. However, it’s still good to understand what DKIM _would_ do if available: - DKIM signatures attach a cryptographic signature to the message headers, - Receiving mail servers retrieve the [public key](https://www.techtarget.com/searchsecurity/definition/public-key) from DNS, - _And they validate that the message was actually sent by your sender and hasn’t been altered in transit_. Because DKIM is widely recognized as a best practice, many ESPs and outbound mail platforms will sign on your behalf. If in future SpamHero adds DKIM support, you would: 1. Enable DKIM signing from within the SpamHero control panel. 2. Publish the DKIM selector and public key in your DNS (likely via a CNAME or TXT, depending on SpamHero’s instructions). 3. Validate signatures with DKIM lookup tools. For now, SPF remains your primary mechanism with SpamHero. ## SPF, DKIM, and DMARC: How They Work Together You may also be wondering how SPF and DKIM relate to DMARC. DMARC stands for _Domain-based Message Authentication, Reporting & Conformance_ and is a higher-level policy that sits on top of SPF and DKIM to tell receiving mail servers: - What to do if SPF or DKIM _fail_, and - Whether to send you reports on failures. DMARC checks whether: - SPF passed _and aligned_, or - DKIM passed _and aligned_. _Alignment means that the domain in the “From” header matches the domain used for SPF or DKIM validation_. With SpamHero relying on SPF today, you’ll want to ensure your SPF record passes and aligns with your domain so your DMARC policy (if published) functions correctly. If you haven’t published a DMARC record yet, you can do so with tools like DMARC generators, where you choose your preferred policy (none, quarantine, reject) and reporting options. ![Email phishing](https://media.mailhop.org/autospf/images/2026/01/spf-record-office-365-0334.jpg) ## How Do You Troubleshoot and Best Practices? Even after setup, SPF issues can still occur. Here are common pitfalls and how to address them: ### Multiple SPF Records DNS allows only one [SPF TXT record](/blog/how-to-create-an-spf-txt-record/)._If you create a second record for SpamHero instead of merging - SPF fails entirely_. Fix: Merge all sources into one and validate with an SPF checker. ### Exceeding DNS Lookup Limits SPF records that include too many services can hit the DNS lookup limit (10 maximum). AutoSPF can flatten records or optimize includes to stay within limits. ### Delayed DNS Propagation Sometimes it just takes time. _If you’ve recently_ _updated your DNS_ _and authentication still isn’t passing, wait the full propagation window_. ### SPF Doesn’t “Align” Even if SPF passes, DMARC can still fail if domains don’t align._These alignment issues are why DKIM signing (when available) helps - the signature is tied to the domain in the header_. ## Topics [ DKIM ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ SPF ](/tags/spf/)[ SPF record ](/tags/spf-record/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 6m 6 Best practices for maintaining an SPF record Jun 5, 2025 ](/blog/6-best-practices-for-maintaining-an-spf-record/)[ Intermediate 3m Adding your SPF record to your domain provider Sep 2, 2024 ](/blog/adding-your-spf-record-to-your-domain-provider/)[ Intermediate 5m Are Your SPF and DKIM Identifiers Aligned? Jul 18, 2024 ](/blog/are-your-spf-and-dkim-identifiers-aligned/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"SpamHero SPF & DKIM Configuration: The Complete Guide from AutoSPF","description":"At AutoSPF, we know that email authentication isn’t an optional add-on - it’s a foundational requirement for any business that wants reliable inbox.","url":"https://autospf.com/blog/spamhero-spf-dkim-configuration-the-complete-guide-from-autospf/","datePublished":"2026-01-03T18:20:52.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2026-01-03T18:20:52.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/spamhero-spf-dkim-configuration-the-complete-guide-from-autospf/"},"articleSection":"intermediate","keywords":"DKIM, DMARC, SPF, SPF record","wordCount":1446,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2026/01/spf-lookup-4112.jpg","caption":"SpamHero SPF & DKIM Configuration","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"SpamHero SPF & DKIM Configuration: The Complete Guide from AutoSPF","item":"https://autospf.com/blog/spamhero-spf-dkim-configuration-the-complete-guide-from-autospf/"}]} ```