# Cakemail: DKIM and DMARC setup

> How to authenticate your sending domain in Cakemail — verify the sender, add the DKIM and DMARC TXT records and the tracking and bounce CNAME records, and confirm the Authenticated status — with each step linked to Cakemail's current help center.

Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/cakemail

This guide follows Cakemail's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Cakemail's current help page win.

For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc).

## Before you start

- You need access to your domain's DNS settings, usually at your registrar or hosting provider.
- Send from an address on a domain you own. Cakemail's help says: "Authentication works only for a private domain that you control" and a public webmail domain such as `gmail.com` cannot be authenticated ([Authenticating Your Domain](https://docs.cakemail.com/en/docs/senders/authenticating-domains)).

## What Cakemail asks you to publish

| Purpose | Record type | Count | Where the values come from |
|---|---|---|---|
| DKIM | `TXT` | 1 | Name `c[CID]._domainkey.[DOMAIN].`; value shown in **Settings ▸ Domains** |
| DMARC | `TXT` | 1 | Name `_dmarc.[DOMAIN]`; value `v=DMARC1; p=none;` |
| Tracking and bounce | `CNAME` | 2 | `link.[DOMAIN]` and `em.[DOMAIN]`, shown in **Settings ▸ Domains** |

`[DOMAIN]` is your sending domain and `[CID]` your Client ID ([Adding DNS Records](https://docs.cakemail.com/en/docs/senders/adding-dns-records)).

## Step 1 — Verify the sender

A sender must be verified before it can send: "You can only send campaigns from a sender that has been verified".

1. In the left menu, go to **Settings ▸ Senders**.
2. Click **+**, fill in **Sender Name (Public)** and **Email**, and click **Confirm**.
3. Open the verification email sent to that address and click the link. The sender then shows as **VERIFIED**.

Source: [Adding a Sender](https://docs.cakemail.com/en/docs/senders/managing-senders).

## Step 2 — Start authentication

1. In the left menu, go to **Settings ▸ Domains**.
2. In **Sender Domains**, find your sending domain. If it shows **Unauthenticated**, click **Authenticate Domain**. (If the domain is not listed yet, click **Create Sender and Domain** first.)
3. On the first step of the wizard, open your DNS provider in a new tab, or click **Copy instructions** to send the setup to whoever manages your DNS.

Source: [Authenticating Your Domain](https://docs.cakemail.com/en/docs/senders/authenticating-domains).

## Step 3 — Add the DKIM record

At your DNS provider, create the `TXT` record Cakemail shows. Copy the **Name** and **Value** with the **Copy to clipboard** buttons rather than retyping them. The value is offered in four variants: copy **Variant 1**, which Cakemail says "covers the majority of cases".

If your DNS provider only accepts a prefix (for example `..._domainkey` instead of `..._domainkey.yourdomain.com`), that is fine.

Source: [Authenticating Your Domain](https://docs.cakemail.com/en/docs/senders/authenticating-domains).

## Step 4 — Add the DMARC record

Cakemail checks for a DMARC record. If your domain has none, create a `TXT` record with **Name** `_dmarc.yourdomain.com` and **Value** `v=DMARC1; p=none;`.

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy.

Source: [Authenticating Your Domain](https://docs.cakemail.com/en/docs/senders/authenticating-domains).

## Step 5 — Wait for verification and check the status

Click **Continue**. "DNS changes usually take a few hours to apply, and sometimes up to 24–48 hours." Cakemail then checks the DKIM and DMARC records, and the domain shows as **Authenticated**. If it still shows **Unverified** after 48 hours, re-copy the records and check for extra spaces, or contact Cakemail support.

Source: [Authenticating Your Domain](https://docs.cakemail.com/en/docs/senders/authenticating-domains).

## Step 6 — Align the tracking and bounce domains

Cakemail describes this as "not mandatory, but strongly recommended".

1. In **Settings ▸ Domains**, scroll to **Tracking and Bounce domain alignment** and select your domain.
2. Add the two `CNAME` records shown, a **Tracking** record (`link.yourdomain.com`) and a **Bounce** record (`em.yourdomain.com`), exactly as shown.
3. After propagation, each record's **Status** changes from **Not valid** to valid.

The tracking domain carries the links in your campaigns; the bounce domain "receives delivery-status notifications for bouncing emails".

Source: [Tracking and Bounce Domains](https://docs.cakemail.com/en/docs/senders/tracking-and-bounce-domains).

## SPF

Cakemail's current help pages on domain authentication list the DKIM, DMARC, tracking and bounce records. They do not document an SPF record step, so this guide does not give one. Checked on 2026-09-11: every English page of [Cakemail's help center](https://docs.cakemail.com/en/llms.txt); the legacy support.cakemail.com article on sender-domain branding could not be retrieved.

## How alignment works here

DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated.

## Check your setup

Once Cakemail shows **Authenticated**, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your Cakemail DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>`. The selector is the part of the DKIM record name before `._domainkey`. For Cakemail, it is `c` followed by your Client ID, from the DKIM record Name `c[CID]._domainkey.[DOMAIN].`.