What SPF include should I use for Fujifilm DMS?

Request the exact SPF authorization and DNS hostname from Fujifilm DMS. Its public email documentation does not publish a universal include value. Use the supplied authorization at the actual Return-Path domain, and preserve a single SPF record there.

Does Fujifilm DMS support a custom Return-Path?

Fujifilm DMS supports Return-Path alignment. Ask its implementation team to provision your custom bounce domain and provide the required DNS records. Verify a delivered message's Return-Path before assuming that the custom configuration is active on your route.

Why does SPF alignment fail when DMARC passes?

The Return-Path domain does not satisfy SPF alignment with the visible From domain, but a valid DKIM signature does satisfy DKIM alignment. DMARC needs one passing method with alignment. Adding SPF authorization at the From domain does not change a provider-owned Return-Path.

Where do I get the Fujifilm DMS DKIM selector?

Get the selector and public DNS record from the Fujifilm DMS implementation team. On a delivered message, s= in DKIM-Signature identifies the selector and d= identifies the signing domain. Publish the supplied TXT or CNAME record and have the team activate signing.

How do I identify Fujifilm DMS email using rDNS?

Compare the sending IP's PTR hostname with the hostnames and IP inventory confirmed by Fujifilm DMS. Its public email documentation does not publish a verified rDNS suffix list. I also check the delivery log and message authentication results because rDNS alone does not establish the sending platform. rDNS does not authenticate the From domain or make DMARC pass.

Can I enable p=reject immediately for Fujifilm DMS?

Keep an existing reject policy, but verify Fujifilm DMS before it sends production mail. For a new deployment, inspect aggregate reports across the relevant sending cycle, fix legitimate failures, and stage enforcement before reject. Review all authorized senders covered by the policy, not only Fujifilm DMS.

How to set up DMARC/DKIM/SPF for Fujifilm DMS

Fujifilm DMS email authentication setup with SPF, DKIM and DMARC.

Set up Fujifilm DMS by requesting your sending-domain configuration from its implementation team, publishing the SPF and DKIM records they supply, and adding a DMARC TXT record for your visible From domain. I approve the configuration only after a message sent through the intended delivery workflow passes DMARC.

Fujifilm DMS describes subdomain configuration and authentication testing as work performed by its team. Its public email documentation does not provide a universal SPF include, DKIM selector, or domain-authentication menu walkthrough. Request the values for your account before changing DNS.

Add your domain

I start with the Fujifilm DMS account or implementation team and the person who controls the domain's authoritative DNS. Domain registration for this service is a coordinated provisioning step.

Choose the identity: Give Fujifilm DMS the intended From address, such as billing@example.com. If you want a dedicated sending subdomain, agree that identity before requesting records.
Request provisioning: Ask the team to register that domain for your email service and configure DKIM signing with a domain that satisfies your DMARC alignment settings.
Request the Return-Path: Ask for a custom bounce domain, such as bounce.example.com, and the exact SPF, CNAME or MX records needed for its provisioning and bounce handling.
Publish verification: Add any domain-ownership record supplied by Fujifilm DMS at the stated DNS name. Return the published names to the team and request confirmation that verification and sending-domain activation are complete.

Request to send to the Fujifilm DMS implementation teamtext

Please provision example.com for Fujifilm DMS email.
From address: billing@example.com
Requested Return-Path domain: bounce.example.com
Requested DKIM signing domain: example.com
Provide domain-verification DNS names, types and values.
Provide SPF authorization and bounce-routing DNS records.
Provide DKIM selectors and TXT values or CNAME targets.
Confirm activation, sending IPs and expected rDNS hostnames.

Replace the example identities with your own. I keep the supplied record list with the change request so DNS owners and Fujifilm DMS can verify the same configuration.

Use the account-specific record list

Obtain each DNS name, record type and value from Fujifilm DMS. Do not infer an SPF include from its website domain or create a DKIM selector that its mail servers have not been configured to use.

Set up SPF

SPF checks the envelope sender, usually shown as the Return-Path on a delivered email. I configure the domain that Fujifilm DMS actually uses there, rather than automatically editing the visible From domain's SPF record.

Confirm the hostname: Get the exact custom Return-Path domain and SPF authorization from Fujifilm DMS. Confirm that the custom domain will be enabled on your delivery workflow.
Publish the record: If instructed to use TXT, add the supplied authorization to the single SPF record at that hostname. Preserve existing senders when updating a shared SPF record.
Follow delegation instructions: If Fujifilm DMS supplies a CNAME for that hostname, publish the CNAME exactly. A CNAME cannot coexist with TXT or MX records at the same DNS name.
Check the limits: Keep the SPF evaluation within the ten DNS-lookup term limit, including nested includes. Do not publish a second v=spf1 record at the same hostname.

Enter the actual Return-Path hostname in the SPF checker below. A successful check of example.com does not prove that bounce.example.com has the right authorization.

With default relaxed SPF alignment, example.com and bounce.example.com share the same organizational domain. With aspf=s, the Return-Path domain must exactly match the visible From domain.

SPF checker

Find SPF syntax issues, lookup limits, and weak records.

?/16tests passed

After DNS is visible, ask Fujifilm DMS to activate the custom Return-Path and send a fresh test. I check the recipient's authentication results to confirm SPF pass and the expected envelope domain.

A provider-owned Return-Path changes the requirement

If your delivery route still uses a Fujifilm DMS-owned Return-Path, adding Fujifilm DMS to your visible From domain's SPF record does not fix SPF alignment. The provider controls SPF for its own domain. Until the custom Return-Path is active, expect SPF alignment failure; DMARC still passes when a valid DKIM signature has alignment with your From domain.

Set up DKIM

Fujifilm DMS must configure the signing key on its mail servers. I publish the supplied public DNS records and then verify that delivered mail has a passing signature for the intended signing domain.

Obtain the selectors: Request every required selector, its signing domain, and its complete TXT public key or CNAME target. Request a 2048-bit RSA key where supported.
Publish the names: Create each record at selector._domainkey.signing-domain using the exact supplied values. Check whether your DNS editor appends the zone name automatically.
Keep the records exclusive: Use the supplied record type. Do not publish both TXT and CNAME at the same selector hostname, and do not change unrelated DKIM selectors.
Activate and test: Ask Fujifilm DMS to confirm signing is enabled. Send a test and inspect the DKIM-Signature d= and s= values together with the recipient's dkim=pass result.

Inspect a DKIM selector in public DNSbash

# Replace example.com and selector with the supplied values.
dig +short CNAME selector._domainkey.example.com
dig +short TXT selector._domainkey.example.com

A public key appearing in DNS proves only that the record is published. It does not prove that Fujifilm DMS has activated the matching private key or that the signature survives delivery.

Passing DKIM with alignment

For From billing@example.com, a valid signature with d=example.com satisfies both strict and relaxed DKIM alignment. A valid signature with d=mail.example.com satisfies relaxed alignment.

Passing DKIM without alignment

A valid signature using only a provider-owned signing domain authenticates that domain. It does not satisfy DKIM alignment for From billing@example.com.

For key rotation, publish the replacement selector before Fujifilm DMS switches signing. Keep the old public key until queued messages signed with it have had time to finish delivery.

Set up DMARC

DMARC is published in your DNS for the visible From domain. I use p=none for a new deployment while checking legitimate traffic. If your domain already has p=quarantine or p=reject, keep that policy and authenticate Fujifilm DMS before production sending.

Check the current policy: Inspect the existing DMARC record and any parent-domain policy. Update an existing record instead of creating another DMARC record at the same name.
Prepare reporting: Create a working reporting mailbox or use the reporting address issued by your DMARC platform. For a reporting address in another domain, confirm that the destination authorizes external reports.
Publish at the From domain: For billing@example.com, create a TXT record at _dmarc.example.com. For billing@notices.example.com, use _dmarc.notices.example.com for an explicit subdomain policy.
Verify the saved value: Use the checker below to confirm one valid record at the intended name, the intended policy, and the correct reporting destination.

New DMARC record exampledns

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

The exact starting value is v=DMARC1; p=none; rua=mailto:dmarc@example.com. Replace example.com and the reporting address before publishing. p=none requests monitoring; it does not request rejection of mail that fails DMARC.

Use the DMARC record generator to build the record with your reporting destination. Google's DMARC setup documentation also recommends starting with monitoring and tightening the policy after reviewing authentication results.

DMARC checker

Look up a domain's DMARC record and catch policy issues.

?/7tests passed

The starting record uses relaxed SPF and DKIM alignment by default. DMARC passes when at least one authentication method passes and its authenticated domain satisfies alignment with the visible From domain.

Verify and troubleshoot

I test the actual Fujifilm DMS delivery route with non-sensitive sample content. A DNS check alone cannot confirm signing, the selected Return-Path, or message changes after signing.

Send through the workflow: Ask Fujifilm DMS to send a test using the intended From address and production delivery configuration. Test each materially different route or sending identity.
Read trusted results: Inspect Authentication-Results added by the receiving mailbox service. Confirm spf=pass, dkim=pass, and dmarc=pass, then inspect the domains behind those results.
Check the message identities: Compare From with smtp.mailfrom and DKIM header.d. Read s= in DKIM-Signature to identify the selector used on that message.
Trace failures: Recheck the exact DNS names, remove duplicate SPF or DMARC records, follow CNAME targets, and ask Fujifilm DMS to confirm signing and Return-Path activation.

Illustrative delivered-message results, not Fujifilm DMS valuestext

From: billing@example.com
Return-Path: <bounce-id@bounce.example.com>
Authentication-Results: receiving.example;
  spf=pass smtp.mailfrom=bounce.example.com;
  dkim=pass header.d=example.com;
  dmarc=pass header.from=example.com

Use the email tester below for the quickest message-level diagnosis. Send a Fujifilm DMS test email to the address it provides so it can inspect the delivered message and report the authentication results.

The example above passes with relaxed SPF alignment and exact DKIM alignment. If SPF alignment fails but DKIM passes with alignment, DMARC still passes. I investigate authentication failures separately from alignment failures.

Email tester

Send a real email to this address. Suped shows a results button when the test is ready.

?/43tests passed

If records were just changed, check the authoritative DNS response and wait for the previous TTL to expire before retesting. If DKIM fails only after forwarding or a gateway, check whether that hop changed signed content.

Use these symptoms to decide whether the fix belongs in DNS, the Fujifilm DMS configuration, or the message-processing route.

Symptom	Likely issue	Next check
SPF permerror	Duplicates or lookups	Inspect SPF chain
SPF mismatch	Provider Return-Path	Confirm custom domain
DKIM missing	Signing inactive	Confirm activation
DKIM fail	Key or content mismatch	Check key and route
DMARC fail	No passing alignment	Compare authenticated domains
Record missing	Wrong DNS name	Check zone suffix

Common authentication failures and the next check.

Get alerted when it breaks

I monitor authentication after go-live because DNS edits and signing-key changes can break previously working mail. Suped is our DMARC reporting and email authentication platform for detecting those failures and assigning concrete fixes.

Use aggregate reports: Send DMARC aggregate reports to the reporting destination configured for Suped. Keep your intended enforcement policy while updating reporting settings.
Enable notifications: In Suped's notification settings, enable DMARC alerts and weekly summaries. Confirm the recipients so the person responsible for DNS or Fujifilm DMS configuration receives the alerts.
Review the source: Compare reported sending IPs with Fujifilm DMS's confirmed inventory and your delivery logs. Inspect SPF and DKIM alignment failures for that source.
Fix and retest: Use Suped's automated issue detection and steps to fix to locate the failed record or authentication setting. Retest a message and review subsequent aggregate reports.

Suped's DMARC monitoring combines authentication reporting with issue detection and alerts. For this workflow, that gives the team an ongoing view of Fujifilm DMS failures after the initial DNS checks.

Aggregate reports arrive on receiving providers' schedules, often daily. Suped's alerts notify you when the relevant issue is detected; they are not an immediate result for every sent message.

Delivery failures need separate evidence

If DMARC passes but mail still bounces or lands in spam, inspect Fujifilm DMS delivery results and recipient SMTP responses. Suped's blocklist (blacklist) monitoring adds reputation context, but a blocklist result does not prove the cause of a delivery failure.

Secure your domain with p=reject

I move to p=reject after legitimate sending sources are accounted for and their messages consistently pass DMARC. For Fujifilm DMS, the decision should include a complete relevant sending cycle, especially monthly statements and infrequent notices.

Inventory legitimate traffic: Review Fujifilm DMS and every other authorized sender in Suped's reports. Confirm ownership of unfamiliar sources before treating them as legitimate.
Resolve authentication failures: Fix DKIM and custom Return-Path configuration before tightening policy. Keep monitoring existing quarantine or reject deployments without lowering their protection.
Stage enforcement: For a new p=none deployment, move to p=quarantine after verifying legitimate traffic, then review failures and delivery evidence before setting p=reject.
Check policy scope: Review any explicit subdomain records and the parent policy's sp setting. Confirm that strict aspf or adkim settings will not break approved subdomain identities.
Keep monitoring: Preserve the reporting destination, enable alerts, and retest after DNS or delivery changes. Coordinate new domains and signing keys with Fujifilm DMS before they send.

Suped's Hosted DMARC is our option for managing DMARC policy changes with policy staging. Suped's source diagnostics and fix steps help establish whether Fujifilm DMS is ready before increasing enforcement.

Reject policy example after legitimate sending is verifieddns

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Update the existing DMARC record and retain the reporting address and other settings your deployment needs. Do not copy this example over a production record without preserving those values.

p=reject requests rejection of messages that fail DMARC. It does not guarantee inbox placement or prevent abuse of an authorized sending account. Keep Fujifilm DMS delivery monitoring and Suped's authentication alerts active.