MailerLite: SPF, DKIM and DMARC setup

This guide follows MailerLite's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and MailerLite's current help page win.

For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings. MailerLite's help says: "Access the DNS settings of your domain located in the account of your hosting provider" (Domain authentication).
• Send from an address on your own paid domain: MailerLite's setup asks for "an email address that includes your paid domain" (How to use automatic domain authentication). MailerLite: "In light of Google and Yahoo's new sender requirements for email senders, it is required to authenticate your domain if you are using a custom domain for sending." (Domain authentication)

What MailerLite asks you to publish

MailerLite: "Add the DKIM as a CNAME record, the SPF as a TXT record, and a Domain verification as a TXT record." (Domain authentication)

Step 1 — Add the domain

1. Go to the Account settings page and select the Domains tab.
2. Click Add domain.
3. Enter the email address you want to send from and click Save.

Source: Domain authentication.

Step 2 — Choose automatic or manual authentication

When a popup offers to start authentication, click Continue to use the automatic setup: it scans your domain, detects your DNS provider, and asks you to log in to that provider and authorize MailerLite to add the records. If you do not have the login, Forward login to someone else shares a link with someone who does.

For the manual path, choose Or manually authenticate your domain, select your DNS provider from the dropdown (or Other), and click Continue. MailerLite shows the Name and Value fields for the DKIM, SPF and domain verification records. If you log in to your DNS provider with a social login such as Gmail, use the manual path: "this type of login is not supported."

Sources: Domain authentication, How to use automatic domain authentication.

Step 3 — Add the DKIM, SPF and verification records

At your DNS provider, add the DKIM record as a CNAME, and the SPF and domain verification records as TXT records, using the Name and Value MailerLite shows. "These records cannot be modified within MailerLite, so they have to be an exact match."

• DKIM: the name is litesrv._domainkey; most DNS providers add your domain to the end of it. If yours also appends the domain to the value, enter the value with a trailing period: litesrv._domainkey.mlsend.com.
• SPF and domain verification: the name is your root domain. Depending on your provider, leave it blank or enter @.
• An existing SPF record: a domain can have only one. MailerLite: "It is only possible to have one SPF record in the DNS zone of your domain." Merge MailerLite's include:_spf.mlsend.com into your existing record instead of adding a second one (How to merge SPF records).

Sources: Domain authentication, Troubleshooting domain authentication.

Step 4 — Add the DMARC record

MailerLite's authentication flow does not generate a DMARC record. Its help describes DMARC as a record "set up on the DNS settings of a domain as a TXT record", gives v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com as an example of a basic record, and recommends DMARC "if you frequently send high volumes of emails (around 5k+)" (The basics of DMARC). The record goes at _dmarc.yourdomain.com (RFC 7489 §6.1).

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

Source: The basics of DMARC.

Step 5 — Check the records and the status

1. Go back to the Domains tab and click Authenticate next to the domain.
2. Click Check DNS Records. If the records match, they are approved and the domain is authenticated.

"It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes." With the automatic setup, the domain shows Pending until then. If a record is not approved, follow MailerLite's troubleshooting article: when it finds more than one SPF record, Check DNS records shows a merged SPF value to publish in place of the existing ones.

Sources: Domain authentication, How to use automatic domain authentication.

Step 6 — Optionally, set up domain alignment

MailerLite's domain alignment puts a subdomain of yours in the email headers and tracked links. It is "not mandatory, but it is highly recommended." Your domain must be authenticated first.

1. On the Domains tab, under Sending domains, click Add custom domain next to the authenticated domain.
2. Under Subdomain prefix, enter an unused prefix (for example newsletter) and click Add.
3. Use the automatic setup, or click Check DNS records and add the A, MX and TXT records from the Manual tab.
4. Once the records are accepted (up to 24 hours), toggle domain alignment ON on the Domains page.

Keep your From address on your main domain, not the alignment subdomain. If you turn alignment off, links in campaigns already sent with it no longer work.

Source: How to align your domain.

SPF

MailerLite's setup includes an SPF TXT record, covered in Step 3. It is one of the records Check DNS Records approves. Because a domain can have only one SPF record (more than one is a permerror, see SPF), merge it with any existing SPF record following How to merge SPF records.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.

Check your setup

Once MailerLite shows the domain as authenticated, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your MailerLite DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For MailerLite, it is litesrv, from the DKIM CNAME name litesrv._domainkey (Troubleshooting domain authentication).