# MailerLite: SPF, DKIM and DMARC setup > How to authenticate your sending domain in MailerLite — add the domain, add the DKIM CNAME record and the SPF and domain verification TXT records, add a DMARC record, and confirm the domain is authenticated — with each step linked to MailerLite's current help center. Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/mailerlite This guide follows MailerLite's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and MailerLite's current help page win. For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc). ## Before you start - You need access to your domain's DNS settings. MailerLite's help says: "Access the DNS settings of your domain located in the account of your hosting provider" ([Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain)). - Send from an address on your own paid domain: MailerLite's setup asks for "an email address that includes your paid domain" ([How to use automatic domain authentication](https://www.mailerlite.com/help/automatic-domain-authentication)). MailerLite: "In light of Google and Yahoo's new sender requirements for email senders, it is required to authenticate your domain if you are using a custom domain for sending." ([Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain)) ## What MailerLite asks you to publish | Purpose | Record type | Count | Where the values come from | |---|---|---|---| | DKIM | `CNAME` | 1 | Name and value shown in MailerLite; the name is `litesrv._domainkey` | | SPF | `TXT` | 1 | Value shown in MailerLite; includes `include:_spf.mlsend.com` | | Domain verification | `TXT` | 1 | Name and value shown in MailerLite; name is your root domain | | DMARC | `TXT` | 1 | Not generated by MailerLite; see Step 4 | MailerLite: "Add the DKIM as a CNAME record, the SPF as a TXT record, and a Domain verification as a TXT record." ([Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain)) ## Step 1 — Add the domain 1. Go to the **Account settings** page and select the **Domains** tab. 2. Click **Add domain**. 3. Enter the email address you want to send from and click **Save**. Source: [Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain). ## Step 2 — Choose automatic or manual authentication When a popup offers to start authentication, click **Continue** to use the automatic setup: it scans your domain, detects your DNS provider, and asks you to log in to that provider and authorize MailerLite to add the records. If you do not have the login, **Forward login to someone else** shares a link with someone who does. For the manual path, choose **Or manually authenticate your domain**, select your DNS provider from the dropdown (or **Other**), and click **Continue**. MailerLite shows the **Name** and **Value** fields for the DKIM, SPF and domain verification records. If you log in to your DNS provider with a social login such as Gmail, use the manual path: "this type of login is not supported." Sources: [Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain), [How to use automatic domain authentication](https://www.mailerlite.com/help/automatic-domain-authentication). ## Step 3 — Add the DKIM, SPF and verification records At your DNS provider, add the DKIM record as a `CNAME`, and the SPF and domain verification records as `TXT` records, using the **Name** and **Value** MailerLite shows. "These records cannot be modified within MailerLite, so they have to be an exact match." - **DKIM:** the name is `litesrv._domainkey`; most DNS providers add your domain to the end of it. If yours also appends the domain to the value, enter the value with a trailing period: `litesrv._domainkey.mlsend.com.` - **SPF and domain verification:** the name is your root domain. Depending on your provider, leave it blank or enter `@`. - **An existing SPF record:** a domain can have only one. MailerLite: "It is only possible to have one SPF record in the DNS zone of your domain." Merge MailerLite's `include:_spf.mlsend.com` into your existing record instead of adding a second one ([How to merge SPF records](https://www.mailerlite.com/help/how-to-merge-spf-records)). Sources: [Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain), [Troubleshooting domain authentication](https://www.mailerlite.com/help/troubleshooting-domain-authentication). ## Step 4 — Add the DMARC record MailerLite's authentication flow does not generate a DMARC record. Its help describes DMARC as a record "set up on the DNS settings of a domain as a TXT record", gives `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` as an example of a basic record, and recommends DMARC "if you frequently send high volumes of emails (around 5k+)" ([The basics of DMARC](https://www.mailerlite.com/help/the-basics-of-dmarc)). The record goes at `_dmarc.yourdomain.com` ([RFC 7489 §6.1](https://www.rfc-editor.org/rfc/rfc7489#section-6.1)). If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy. Source: [The basics of DMARC](https://www.mailerlite.com/help/the-basics-of-dmarc). ## Step 5 — Check the records and the status 1. Go back to the **Domains** tab and click **Authenticate** next to the domain. 2. Click **Check DNS Records**. If the records match, they are approved and the domain is authenticated. "It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes." With the automatic setup, the domain shows **Pending** until then. If a record is not approved, follow MailerLite's [troubleshooting article](https://www.mailerlite.com/help/troubleshooting-domain-authentication): when it finds more than one SPF record, **Check DNS records** shows a merged SPF value to publish in place of the existing ones. Sources: [Domain authentication](https://www.mailerlite.com/help/how-to-verify-and-authenticate-your-domain), [How to use automatic domain authentication](https://www.mailerlite.com/help/automatic-domain-authentication). ## Step 6 — Optionally, set up domain alignment MailerLite's **domain alignment** puts a subdomain of yours in the email headers and tracked links. It is "not mandatory, but it is highly recommended." Your domain must be authenticated first. 1. On the **Domains** tab, under **Sending domains**, click **Add custom domain** next to the authenticated domain. 2. Under **Subdomain prefix**, enter an unused prefix (for example `newsletter`) and click **Add**. 3. Use the automatic setup, or click **Check DNS records** and add the `A`, `MX` and `TXT` records from the **Manual** tab. 4. Once the records are accepted (up to 24 hours), toggle domain alignment **ON** on the Domains page. Keep your From address on your main domain, not the alignment subdomain. If you turn alignment off, links in campaigns already sent with it no longer work. Source: [How to align your domain](https://www.mailerlite.com/help/how-to-align-a-domain). ## SPF MailerLite's setup includes an SPF `TXT` record, covered in Step 3. It is one of the records **Check DNS Records** approves. Because a domain can have only one SPF record (more than one is a **permerror**, see [SPF](https://emailmarketing.net/learn/authentication/spf)), merge it with any existing SPF record following [How to merge SPF records](https://www.mailerlite.com/help/how-to-merge-spf-records). ## How alignment works here DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated. ## Check your setup Once MailerLite shows the domain as authenticated, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC. The check looks for DKIM under a fixed list of common selectors, so it may not find your MailerLite DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=`. The selector is the part of the DKIM record name before `._domainkey`. For MailerLite, it is `litesrv`, from the DKIM CNAME name `litesrv._domainkey` ([Troubleshooting domain authentication](https://www.mailerlite.com/help/troubleshooting-domain-authentication)).