Email Authentication with Multiple Sending Services
Modern businesses often use multiple email service providers (ESPs) for different purposes. This guide explains how to properly configure SPF, DKIM, and DMARC when using multiple sending services without breaking email authentication.
The Challenge of Multiple ESPs
It's common for organizations to use different services for different email types. A typical setup might include:
Each of these services needs to be authorized to send email on behalf of your domain. Without proper configuration, emails may fail authentication checks and end up in spam folders or be rejected entirely.
SPF Record Management
SPF (Sender Policy Framework) allows you to specify which mail servers are authorized to send email for your domain. Each ESP typically requires you to add an include: mechanism to your SPF record.
Example Multi-ESP SPF Record
v=spf1 include:_spf.google.com include:sendgrid.net include:mail.zendesk.com include:servers.mcsv.net ~allThis record authorizes Google Workspace, SendGrid, Zendesk, and Mailchimp to send emails for your domain.
The 10 DNS Lookup Limit
SPF records are limited to 10 DNS lookups. Exceeding this limit causes SPF to fail with a "permerror" result, potentially sending your emails to spam.
Each include:, a:, mx:, and redirect: mechanism counts as a lookup. The problem is that includes can be nested - an ESP's SPF record may include other records, each counting toward your limit.
How Lookups Add Up Quickly
| Service | DNS Lookups |
|---|---|
| Google Workspace | 3-4 lookups |
| Microsoft 365 | 2-3 lookups |
| SendGrid | 1 lookup |
| Mailchimp | 2 lookups |
| Zendesk | 1-2 lookups |
| Total | 9-12 lookups |
Solutions for the Lookup Limit
Replace include mechanisms with the actual IP addresses they resolve to. Requires regular updates as ESP IPs change. Services like SPF flattening tools can automate this.
Move services to subdomains (e.g., marketing.example.com) - each subdomain gets its own 10-lookup limit. This is the recommended approach.
Advanced technique using macros to dynamically construct SPF checks. Complex to implement but can help in some scenarios.
DKIM with Multiple Services
Unlike SPF, DKIM scales well with multiple services. Each service uses its own selector (a unique identifier), so there's no conflict between different ESPs signing your emails.
How DKIM Selectors Work
Each ESP provides a unique DKIM selector for their signing. You add multiple DKIM records to your DNS, each at a different selector subdomain:
# Google Workspace DKIM
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANB..."
# SendGrid DKIM
s1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."
# Mailchimp DKIM
k1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."
# Zendesk DKIM
zendesk1._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0..."
Good news: There's no limit on how many DKIM records you can have. Each ESP can have its own selector without affecting the others.
DKIM Best Practices for Multiple ESPs
- Always enable DKIM signing for every ESP you use
- Use 2048-bit keys when available (more secure than 1024-bit)
- Document which selector belongs to which service
- Rotate keys periodically (annually is a good practice)
- Remove DKIM records for services you no longer use
DMARC Alignment with Multiple Services
DMARC requires that either SPF or DKIM aligns with the From domain. Alignment means the domains match (in relaxed mode) or are identical (in strict mode).
Understanding Alignment Modes
| Mode | SPF Alignment | DKIM Alignment |
|---|---|---|
| Relaxed (default) | Return-Path domain matches or is subdomain of From | DKIM d= domain matches or is subdomain of From |
| Strict | Return-Path domain exactly matches From | DKIM d= domain exactly matches From |
Common Alignment Issues
If an ESP sends from their domain (e.g., mail.esp.com) instead of yours, neither SPF nor DKIM will align with your From address.
When emails are forwarded, SPF often breaks. Ensure DKIM is always configured as a backup for alignment.
Configure each ESP to use your domain for the Return-Path (envelope from) and DKIM signing domain. Most ESPs support this as "custom sending domain" or "domain authentication."
DMARC Record for Multiple Services
You only need one DMARC record for your domain. Use aggregate reports to monitor all services:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com; adkim=r; aspf=r; pct=100Subdomain Strategies for Separating Services
Using subdomains for different email types is a best practice that solves multiple problems: SPF lookup limits, reputation isolation, and easier troubleshooting.
Recommended Subdomain Structure
| Subdomain | Purpose | ESP Example |
|---|---|---|
| mail.example.com | Transactional emails | SendGrid, Postmark |
| marketing.example.com | Marketing campaigns | Mailchimp, HubSpot |
| support.example.com | Support tickets | Zendesk, Freshdesk |
| example.com | Corporate email | Google, Microsoft |
Benefits of Subdomains
Each subdomain has its own SPF record with a fresh 10-lookup limit. No more worrying about exceeding limits.
If marketing emails get spam complaints, it won't affect your transactional email reputation. Each subdomain builds its own sender reputation.
When issues arise, you can quickly identify which service and email type is affected by looking at the subdomain.
You can set different DMARC policies per subdomain. Start new services with p=none while keeping your main domain at p=reject.
Example DNS Setup for Subdomains
# Main domain - Corporate email only
example.com TXT "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
# Marketing subdomain
marketing.example.com TXT "v=spf1 include:servers.mcsv.net ~all"
_dmarc.marketing.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
# Transactional subdomain
mail.example.com TXT "v=spf1 include:sendgrid.net ~all"
_dmarc.mail.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
# Support subdomain
support.example.com TXT "v=spf1 include:mail.zendesk.com ~all"
_dmarc.support.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
Implementation Checklist
- 1.Inventory all services that send email on your behalf
- 2.Decide on subdomain strategy based on email types and volumes
- 3.Count your SPF lookups and flatten or use subdomains if over 10
- 4.Configure custom sending domains in each ESP for DKIM alignment
- 5.Set up DMARC with rua reporting to monitor all services
- 6.Test email authentication for each service before going live
- 7.Monitor DMARC reports regularly to catch alignment issues
Resources
Audit Your Email Authentication
Use our scanner to check if all your sending services are properly authenticated and count your SPF lookups.
Scan Your Domain