How to set up DMARC/DKIM/SPF for Employment Hero
Published 19 Jun 2026
Updated 25 Oct 2026
12 min read
Summarize with
Updated on 25 Oct 2026: We clarified Employment Hero's SPF guidance, DKIM hostname entry, and Mail Log checks for missing payroll email.
Employment Hero Payroll classic signs email with DKIM after you add your domain, publish the generated CNAME records, and validate the domain inside Email Sender Authentication. Keep one SPF record at each MAIL FROM domain you control, and add Employment Hero's supplied mechanism only when that domain is used for the message's return-path. DMARC belongs on your domain, starts at p=none for monitoring, and moves to p=reject only after Employment Hero and every other legitimate sender passes DMARC through aligned SPF or DKIM.
These steps apply to Employment Hero Payroll classic. For email sent by another Employment Hero product, check its sender-authentication instructions and the received message headers separately.
Add your domain
Start in Employment Hero Payroll classic. The Payroll classic article places this under Business Settings, Payroll Settings, then Email Sender Authentication. You need Employment Hero admin access and DNS access for the domain you use in the visible From address. Publish records at the DNS host for your authoritative nameservers, even if your registrar or mailbox provider is elsewhere. Employment Hero authentication does not require changes to your existing MX records.
Employment Hero Payroll classic Email Sender Authentication page with an unvalidated domain.
- Open settings: Go to Business Settings, Payroll Settings, then Email Sender Authentication.
- Add domain: Click Add and enter only the domain, such as example.com, not a full email address.
- Register domain: Click Register and leave the generated DNS records open while you update DNS.
- Publish records: Add every CNAME record Employment Hero provides at your DNS host.
- Validate status: Return to Email Sender Authentication and click Unvalidated so Employment Hero checks DNS.
- Use brand level: For partner setups, use Brand management, then Email Sender Authentication, so the domain applies across the brand.
Employment Hero registers a validated domain across the payroll database. If you see "Domain is already registered", locate the existing business-level or brand-level registration and check which businesses rely on it before deleting or re-adding it.
- Same domain: Keep one validated setup when multiple businesses send with the same domain.
- Different domains: Register each From domain separately so DKIM signs with the correct domain.
Choose the From address
Employment Hero applies DKIM only when the visible From address uses a validated domain. Payroll classic can draw that address from several settings, so confirm the field used by each notification type before sending a test.
|
|
|
|---|---|---|
Leave, expense, roster, and other notifications | Business Details: Contact Email Address | noreply@yourpayroll.io when the contact address uses a restricted domain |
Payslips with an employing entity address | Employing Entities: Pay Slip Notification from Email Address | The Pay Slips notification address |
Other payslip notifications | Pay Slips: Email Notification from Email Address | The Business Details contact address |
Payroll classic From address selection
Payroll classic restricts Yahoo, Gmail, Googlemail, Outlook, Hotmail, and Bigpond domains. You cannot authenticate these consumer domains because you do not control their DNS. Business Details allows a restricted address to be saved but sends notifications as noreply@yourpayroll.io. The Pay Slips and Employing Entities sender fields reject restricted addresses. Use an address on a domain your organization controls.
Set up SPF
SPF for Employment Hero depends on the domain in the MAIL FROM, also shown as the return-path, rather than the visible From address. Email Sender Authentication uses DKIM CNAME records, while Employment Hero's separate delivery troubleshooting guidance also includes SPF advice. Confirm with Employment Hero which SPF mechanism applies to your account and whether its return-path uses a domain you control.
- Find current SPF: Check the SPF TXT record at the actual MAIL FROM domain before editing anything. A subdomain does not inherit the root domain's SPF record.
- Ask for source: Add only the exact SPF mechanism Employment Hero supplies for your account when its return-path uses a domain you control.
- Keep one record: Merge SPF into a single TXT record. Multiple SPF records at the same host break SPF.
- Count lookups: Allow at most 10 DNS-querying SPF mechanisms and modifiers during evaluation, including nested includes and redirects. Exceeding the limit causes permerror.
- Accept DKIM pass: If Employment Hero uses its own return-path, SPF can pass without aligning. Aligned DKIM is enough for DMARC.
SPF syntax example, not an Employment Hero valuedns
example.com. TXT "v=spf1 include:your-approved-sender.example -all"
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
The example include is a placeholder. When merging a verified mechanism, preserve existing authorized senders and the current all qualifier. Use the SPF checker after each DNS edit to confirm one valid SPF record and a lookup count within the limit.
|
|
|
|---|---|---|
Employment Hero supplies SPF for an aligned return-path | SPF supports DMARC when authorization passes | Merge the verified mechanism into that host's existing SPF record. |
Employment Hero uses its own return-path | SPF can pass without DMARC alignment | Publish the supplied DKIM CNAMEs and verify aligned DKIM. |
Duplicate SPF | SPF permerror | Merge records into one TXT value. |
SPF choices for Employment Hero messages
SPF helps DMARC only when the authenticated MAIL FROM domain aligns with the visible From domain. DMARC requires one aligned pass, so Employment Hero can pass DMARC through aligned DKIM even when SPF alignment is unavailable for a message type.
Set up DKIM
DKIM is the main Employment Hero authentication step. Once the domain is registered, Employment Hero generates CNAME records. Those records let Employment Hero sign payslip notifications, leave or expense request emails, report packs, and other payroll messages with your domain.
Employment Hero Payroll classic showing generated DKIM CNAME records for a domain.
- Copy hosts: Copy each CNAME host exactly as Employment Hero displays it.
- Copy values: Copy the target value exactly, including the trailing domain if shown.
- Check suffixes: If your DNS host auto-adds example.com, enter the relative hostname, such as selector1._domainkey. Keep the _domainkey label; do not enter just selector1.
- Set TTL: Use the DNS host default TTL unless your change window needs a shorter value.
- Validate DKIM: Return to Employment Hero and click Unvalidated after DNS publishes. If validation still fails, check the complete hostname and target, then allow cached DNS answers to expire before retrying.
Illustrative DKIM CNAMEs, use account-generated valuesdns
selector1._domainkey.example.com. CNAME selector1.vendor.example. selector2._domainkey.example.com. CNAME selector2.vendor.example.
The DKIM setup guide notes a common validation issue: some DNS hosts append your domain automatically. If validation fails, remove the repeated domain suffix from the host field and try validation again.
Correct DNS entry
- Host field: Keep the complete selector hostname, including _domainkey, with no duplicated domain suffix.
- Record type: Use CNAME, not TXT, unless Employment Hero gives a TXT record.
Broken DNS entry
- Repeated host: The host ends with the same domain twice.
- Wrong type: A CNAME value pasted into TXT fails Employment Hero validation.
Set up DMARC
DMARC is published at your domain, not inside Employment Hero. Start with a monitoring policy unless your domain already has quarantine or reject working cleanly. If you are already at quarantine or reject and Employment Hero passes aligned DKIM, keep that stronger policy.
Starting DMARC recorddns
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Use v=DMARC1. RFC 9989 marks the pct tag as historic. Stage enforcement by reviewing aggregate reports and changing the policy deliberately rather than relying on percentage sampling.
- Choose mailbox: Replace dmarc@example.com with a monitored aggregate report mailbox or the exact rua destination issued for your domain in Suped. If the destination uses a different organizational domain, confirm that the report receiver publishes external-report authorization.
- Publish host: Create a TXT record at _dmarc.example.com for example.com. A From subdomain inherits an applicable parent policy unless it has its own record. For separate policy at payroll.example.com, use _dmarc.payroll.example.com.
- Use generator: Create the record with the DMARC record generator if you need a record for your domain or a separate subdomain policy.
- Monitor reports: Use DMARC monitoring to separate Employment Hero traffic from other senders.
- Avoid duplicates: Keep exactly one DMARC TXT record at each _dmarc name.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
The DMARC checker should show one parsed record, a valid policy, and a reporting address. Fix syntax before testing Employment Hero traffic because a malformed DMARC record hides the real sender-level result.
Do not jump to p=reject before Employment Hero is validated and visible in DMARC reports. A p=reject policy asks receivers to reject messages that fail DMARC; each receiver determines final handling. Incorrect DKIM therefore puts legitimate payroll notifications at risk.
Verify Employment Hero email authentication
Verification means sending a real Employment Hero email that uses your domain in the visible From address, then checking the authentication result on the received message. Open its full headers and review the Authentication-Results added by the receiving mail server. A dashboard status alone is not enough.
Employment Hero Payroll classic showing a validated sender authentication domain.
- Send sample: Trigger real Employment Hero notifications for each From address configured in Business Details, Pay Slips, and Employing Entities.
- Check DKIM: Confirm dkim=pass and compare the DKIM signing domain, shown as d= in DKIM-Signature or header.d in Authentication-Results, with the visible From domain. Relaxed alignment allows the same organizational domain, while strict alignment requires an exact match.
- Check SPF: Check spf=pass and smtp.mailfrom to identify the authenticated return-path domain. A different organizational domain does not support SPF alignment, even when SPF passes.
- Check DMARC: Confirm dmarc=pass for the visible From domain through aligned DKIM or aligned SPF.
- Check reports: Allow time for aggregate reports, which usually arrive daily, and confirm the source appears under your expected domain.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
Use the email tester after DNS changes. Send it a real Employment Hero message and review the SPF, DKIM, DMARC, header, and content diagnostics in one report.
|
|
|
|---|---|---|
Domain stays unvalidated | CNAME host mismatch | Remove duplicated domain suffix. |
DKIM missing | Wrong From domain | Send using the validated domain. |
SPF alignment fail | Employment Hero return-path | Use aligned DKIM or request an aligned return-path. |
DMARC fail | No aligned pass | Fix DKIM first, then retest. |
Common Employment Hero authentication fixes
Check the Mail Log for missing payroll email
Passing DMARC does not guarantee inbox delivery. Employment Hero's Mail Log instructions explain how to investigate bounced or dropped payroll emails after authentication has been checked.
- Open Business Settings, then Payroll Settings, then Mail Log. Filter by the employee's email address and notification template.
- Check the status. Bounced means the recipient's server refused delivery. Dropped means repeated bounces caused Payroll classic to stop sending to that address.
- Resolve the cause before retrying. Confirm the recipient address and review any rejection details, particularly when sender and recipient use the same domain.
- After fixing the cause, select the affected employee and click Unblock Email Addresses, then confirm delivery of a fresh notification.
Monitor Employment Hero authentication
DNS can drift when a payroll admin changes the sending domain or a DNS migration drops CNAME records. Suped's DMARC reporting platform groups authentication results by source so payroll and DNS owners can investigate Employment Hero failures. Report-based alerts depend on receiving aggregate reports and do not confirm delivery of individual payroll messages.
Notification settings page with DMARC alerts, weekly summary, toggles, and preview buttons
- Enable alerts: Turn on DMARC alerts for failure spikes and newly observed sources as aggregate reports arrive.
- Watch DKIM: Review Employment Hero source reports for missing DKIM or a signing domain that no longer matches your From domain.
- Track SPF: Check SPF errors at the actual return-path domain, including lookup limits and record conflicts. Assess SPF alignment separately from SPF authentication.
- Route summaries: Send weekly summaries to the payroll and DNS owners responsible for sending changes.
- Assign fixes: Use issue steps to give the DNS owner the exact record that needs changing.
Manual monitoring
- Report review: Check aggregate reports yourself for changes in the Employment Hero source.
- Raw reports: Aggregate XML needs parsing before the cause is clear.
Suped monitoring
- Report alerts: Alerts identify changed failure patterns after new reports are processed.
- Clear fix: Issues show the affected source and failure type, plus the DNS action and current status.
Secure your domain with p=reject
Move to p=reject after every legitimate sender is identified and passing DMARC alignment. For Employment Hero, that means validated DKIM CNAME records, confirmed aligned DKIM on real messages, and no unexpected payroll mail showing as unauthenticated in reports.
DMARC policy staging
Use reporting data to move the domain policy only after legitimate sources are passing.
Monitor
p=none
Collect reports and identify every sender.
Limit exposure
p=quarantine
Quarantine only after known senders pass.
Enforce
p=reject
Request rejection for DMARC failures after legitimate senders pass.
- Confirm sources: List Employment Hero and every other sender that uses your domain.
- Fix failures: Resolve authentication failures and forwarding effects before changing policy.
- Stage policy: Review reports across a complete payroll cycle, including infrequent notifications. Move to quarantine first if the domain has many active senders, then to reject after legitimate traffic passes.
- Use hosted controls: Suped Hosted DMARC requires an initial DNS change to connect your domain, then lets you manage policy in Suped without repeating DNS edits.
- Keep alerts on: Keep monitoring after p=reject because authentication failures put legitimate payroll mail at risk of rejection.
Hosted DMARC configuration dialog showing policy controls, CNAME setup, and expanded advanced options
Enforced DMARC value for direct TXT publishingdns
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Keep source-level monitoring active after enforcement and retest Employment Hero whenever its sending domain or DNS records change. If using Suped Hosted DMARC, follow its supplied DNS instructions instead of adding the direct TXT example alongside its CNAME at the same name.
FAQ
Payroll classic's Email Sender Authentication flow uses DKIM CNAME records. Employment Hero also publishes SPF advice in its delivery troubleshooting guidance, so confirm the applicable mechanism and actual return-path before editing DNS. Aligned DKIM is enough for DMARC when SPF does not provide an aligned pass.
Start with p=none using v=DMARC1; p=none; rua=mailto:dmarc@example.com, then replace the report mailbox with your real address. If your domain already uses quarantine or reject successfully, keep that policy.
A common cause is a duplicated domain suffix in the CNAME host field. If your DNS host appends example.com automatically, enter selector1._domainkey for a full host of selector1._domainkey.example.com. Use the actual selector supplied by Employment Hero and allow cached DNS answers to expire before retrying.
No. Payroll classic restricts consumer domains such as Gmail, Yahoo, Outlook, Hotmail, Googlemail, and Bigpond because you cannot change their DNS. Use an address on a domain your organization controls. Some restricted-domain notifications fall back to noreply@yourpayroll.io.
Move to p=reject after Employment Hero and every other legitimate sender passes DMARC through aligned SPF or DKIM across a complete payroll cycle. Keep monitoring active to detect later failures; aggregate reports arrive after sending, so they cannot guarantee advance warning of blocked payroll email. Do not use the historic pct tag for partial enforcement.
