Email domain authentication: SmartyTap docs

Gmail, Outlook and Yahoo check that an email really comes from the domain in the From address. Three DNS records prove it:

SPF lists the servers allowed to send for your domain.
DKIM adds a signature to every email that only your domain's public key can confirm.
DMARC tells inbox providers what to do with mail that fails SPF or DKIM, and where to send reports.

Authenticated email reaches the inbox far more often than unauthenticated email, and the big inbox providers expect it from anyone sending marketing at volume. SmartyTap generates every record for you; you add them at your DNS provider (GoDaddy, Cloudflare, Namecheap, Google Domains, Shopify domains and so on).

Use a subdomain

SmartyTap suggests sending marketing from a subdomain such as mail.yourbrand.com. Customers still see your brand, and your main domain's reputation, which your everyday mailbox depends on, stays separate from your campaigns.

Before you start

Access to your domain's DNS settings, or someone who has it.
Your privacy policy link and your business's physical mailing address. Marketing email must include a physical address.

Set up your sending domain

Open Email Setup

Go to SmartyTap > Settings > Email Setup. The page opens on an email setup checklist.

Add your domain

Under Brand sending identity, enter your Brand root domain (for example yourbrand.com) and the Sender domain you'll send from (for example mail.yourbrand.com). Add your Privacy policy URL and Physical address. SmartyTap fills in the reply, return-path and tracking domains for you. Click Create sender domain.

Prove you own it

Under DNS ownership, click Issue ownership challenge. SmartyTap shows a TXT record (its host and value). Add it at your DNS provider, then click Verify ownership now. When it passes you'll see "DNS ownership is verified."

Add the authentication records

Under DNS auth validation, SmartyTap lists every record, grouped as Ownership, Authentication, Routing and Tracking. Use Copy host and Copy value on each, or Copy all DNS records to send them to whoever manages your DNS.

Check them

Click Check DNS and auth. The SPF, DKIM and DMARC pills turn to Passing one by one. When all pass, you'll see "Sending auth is verified."

The records SmartyTap asks for

Copy the exact values from the page; this list explains what each one is for.

SPF: a TXT record on your sender domain that starts with v=spf1 and allows Chargezen's mail servers.
DKIM: a TXT record at mail2026a._domainkey. plus your sender domain, holding your public key.
DMARC: a TXT record at _dmarc. plus your root domain, starting with v=DMARC1; p=none, which sends reports so problems show up without blocking any mail.
Routing: MX records so replies reach you (on a reply subdomain such as reply.yourbrand.com) and bounces come back to SmartyTap (on a return-path subdomain such as bounce.mail.yourbrand.com), plus an A record for the return path.
Tracking: a CNAME on a tracking subdomain such as trk.mail.yourbrand.com.

Only one SPF and one DMARC record per name

If your domain already has a DMARC record at _dmarc, don't add a second one; a domain with two DMARC records is treated as having none. Keep your existing record or merge the two. The same goes for SPF on a given host: merge the include or ip4 parts into one record. Sending from a subdomain avoids most of these clashes.

Statuses

Each of SPF, DKIM and DMARC shows one of these:

Pending or Validating: not checked yet, or the check is running.
Valid: the record is in place and correct.
Invalid: the record is missing or its value doesn't match. Copy the value again and check for extra quotes or spaces your DNS provider added.
Drifted: the record passed before but changed since, for example after a DNS move. The page says auth drift is open; fix the record and click Check DNS and auth.

After you're verified

Add the mailboxes you'll send from (like hello@mail.yourbrand.com) under SmartyTap > Settings > Email Setup and the Email Mailboxes page, then pick one as the Sender on your campaign.
A new domain starts slowly. See Sending-domain warm-up.
Once a few weeks of DMARC reports look clean, you can make your policy stricter (p=quarantine, then p=reject) to stop others from spoofing your domain.

Troubleshooting and FAQ

How long do DNS changes take?

Usually minutes, sometimes up to a day or two, depending on your DNS provider. If a check fails right after you add a record, wait a little and click Check DNS and auth again.

I use Cloudflare. Anything special?

Set the tracking CNAME to DNS only (grey cloud) so it points straight at Chargezen.

My DNS provider adds my domain to the host automatically

Many do. If the host shows as mail.yourbrand.com.yourbrand.com, enter only the part before your root domain (for example mail or _dmarc).

Does SmartyTap support BIMI?

Not today. BIMI shows your logo next to authenticated mail in some inboxes and needs a strict DMARC policy first.

Guides

On the product page

Learn more

Black Friday email and SMS checklist

Email domain authentication