How to set up DMARC/DKIM/SPF for Simplelists
For a Simplelists Multiple Lists account, add the sending domain under General Settings > Domains, publish the MX and DKIM records shown there, and add DMARC at _dmarc. Simplelists does not provide Return-Path alignment for this setup, so SPF does not need a Simplelists entry to make DMARC pass. I rely on DKIM alignment for Simplelists mail and expect SPF alignment errors when its separate bounce domain appears in the Return-Path.
The result to aim for
A delivered Simplelists message should show DKIM pass with the DKIM signing domain matching the visible From domain, followed by DMARC pass. SPF can pass for a Simplelists bounce domain yet still fail DMARC alignment. That result is acceptable when DKIM provides the aligned pass.
Add your domain
Full custom-domain integration requires a Simplelists Multiple Lists account. A Single List account can receive mail through a forwarded address, but it does not provide the same domain-level setup. I use a dedicated subdomain when the root domain already receives staff mail, because changing root MX records reroutes all inbound mail for that domain.
- Open the domain panel. Sign in to Simplelists, select the Multiple Lists account, then open General Settings > Domains.
- Add the exact domain. Enter the domain that will appear after the @ in list addresses, select Add, then mark it as primary if it should be the default.
- Publish both MX records. Create the primary and secondary MX records with different priorities. Simplelists documents mx1.simplelists.com as primary and mx2.simplelists.com as secondary.
- Confirm the list address. Open Manage Lists, select the list, and confirm that its address uses the new domain before sending a live test.
Simplelists MX recordsDNS
example.com. MX 10 mx1.simplelists.com. example.com. MX 20 mx2.simplelists.com.
Use the host and priority fields required by your DNS provider. Some panels use @ for the root host and add the trailing dot automatically. Wait for DNS propagation, then refresh the domain status in Simplelists.
Simplelists Domains tab with a custom domain and DNS status
Protect existing inbound mail
Do not replace the root domain's MX records if it already hosts employee mail. Use a dedicated list subdomain, add that subdomain to Simplelists, and publish the Simplelists records only on that subdomain.
Set up SPF
Simplelists uses a separate bounce address in the Return-Path and does not support Return-Path alignment for the visible From domain in this configuration. I do not add a guessed Simplelists include to the organizational SPF record solely to fix DMARC. Keep the existing SPF record for the systems that use your domain in their Return-Path.
- Inspect the Return-Path. Send a list message, view its raw headers, and compare the Return-Path domain with the visible From domain.
- Preserve one SPF record. Do not publish a second v=spf1 TXT record. Merge only the authorized sources that really use your domain as their envelope sender.
- Avoid a false fix. An SPF pass for a Simplelists-controlled Return-Path does not satisfy DMARC when that domain differs from the From domain.
- Require DKIM instead. Treat aligned DKIM as the required DMARC path for Simplelists and investigate any message where DKIM fails.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
The SPF checker confirms whether the domain has one syntactically valid SPF record and whether it exceeds the ten-lookup limit. It does not prove that Simplelists has DMARC-aligned SPF, because that depends on the domain used in each message's Return-Path.
If the current Simplelists Domains screen supplies an SPF value for another account function, publish only that exact current value after confirming why it is needed. Do not treat the UI's SPF status as proof of DMARC alignment for list mail.
Expected authentication patternTEXT
spf=pass smtp.mailfrom=bounce.simplelists.com dkim=pass header.d=example.com dmarc=pass header.from=example.com
Set up DKIM
DKIM is the critical DMARC authentication path for Simplelists. The private key remains with Simplelists, while you publish the public key shown for your domain. Never generate an unrelated key pair, because Simplelists cannot sign with a private key it does not hold.
- Open the DNS instructions. In Simplelists, open General Settings > Domains and select the custom domain.
- Copy the selector host. Copy the full DKIM hostname shown by Simplelists, including the selector and _domainkey label.
- Publish the public key. Create one TXT record and paste the displayed DKIM value without changing spacing or wrapping.
- Check host expansion. If the DNS provider automatically appends your domain, enter only the selector host so the domain is not duplicated.
- Refresh verification. Wait for DNS propagation, refresh the Simplelists Domains page, then send a new message after the status changes.
Simplelists DKIM DNS instructions for a custom domain
The selector and public key vary by account, so the Simplelists screen is the source of truth. A generic record can show the structure, but it must not replace the generated value.
DKIM record structureDNS
Host: <selector>._domainkey Type: TXT Value: v=DKIM1; k=rsa; p=<key-from-Simplelists>
Check the signing domain
A DKIM signature can pass cryptographically and still fail DMARC alignment. In the raw header, confirm that header.d uses your From domain or its organizational domain. The Simplelists comparison explains the separate jobs of DKIM and DMARC.
Set up DMARC
DMARC belongs in your DNS, not in Simplelists. Publish one TXT record at _dmarc for the domain in the visible From address. Start with p=none only when the domain has no stronger policy. If it already uses p=quarantine or p=reject, keep that policy and fix Simplelists DKIM instead of downgrading protection.
- Check for an existing record. Query _dmarc.example.com and edit the existing record rather than publishing a second one.
- Create the reporting mailbox. Make sure dmarc@example.com can receive aggregate reports, or replace it with the reporting address you actively monitor.
- Publish the TXT record. Use host _dmarc and the exact monitoring record below for a domain with no current policy.
- Wait before testing. Allow for the DNS TTL, then query the authoritative result and send a fresh Simplelists message.
- Keep enforcement intact. Do not change quarantine or reject to none during onboarding. Correct the DKIM record and confirm the new mail passes.
Starting DMARC recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Use the DMARC record generator if you need a different aggregate-report address, strict alignment tags, or staged enforcement settings. Keep the generated output as one TXT value.
DMARC needs only one aligned pass, either SPF or DKIM. For Simplelists, the target is DKIM pass plus DMARC alignment through the DKIM signing domain.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
The checker should return one valid DMARC record, a recognized policy, and a valid rua URI. Fix duplicate records, missing semicolons, or an invalid reporting address before relying on report data.
Verify and troubleshoot
DNS status alone is not enough. I verify a message that Simplelists has actually redistributed to a recipient outside the sending domain, because that path includes Simplelists signing, Return-Path handling, and any From rewriting used for mailing-list compatibility.
- Send a clean sample. Post to the list using an authorized sender and deliver it to a mailbox outside your domain.
- Open the raw message. Find Authentication-Results, DKIM-Signature, Return-Path, From, and the earliest Simplelists Received header.
- Confirm DKIM pass. Require dkim=pass and confirm that the d= domain has DMARC alignment with the visible From domain.
- Interpret SPF correctly. Accept an SPF alignment failure when the Return-Path uses a Simplelists domain and DKIM supplies the aligned pass.
- Require DMARC pass. Check for dmarc=pass with header.from set to the domain that subscribers see.
- Check delivery evidence. In Simplelists, open Email Delivery, select the message, and review the recipient status and receipt details.
The email tester gives the fastest end-to-end check. Send the generated test address a message through the Simplelists list, not directly through your normal mailbox, so the report measures the correct path.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
Read the tester result by identity. The visible From domain, DKIM d= domain, SPF MAIL FROM domain, and DMARC result should explain one another. A green SPF result for a different domain does not remove the need for DKIM alignment.
|
|
|
|---|---|---|
DKIM | Pass | Fix key or selector |
DKIM domain | Matching | Check custom domain |
SPF alignment | Optional | Rely on DKIM |
DMARC | Pass | Trace alignment |
Expected Simplelists authentication results
Simplelists Email Delivery page with recipient status details
Common failure points
- Duplicate host. The DNS panel appended the domain to an already complete DKIM hostname.
- Broken public key. Quotes, spaces, or line wrapping changed the DKIM TXT value.
- Wrong From domain. The list sent with a domain that was not added and verified in Simplelists.
- Misread SPF failure. The message has an unaligned Return-Path, which is acceptable only when aligned DKIM passes.
Get alerted when it breaks
A one-time header check cannot catch a later DNS edit, expired selector, new list domain, or Simplelists configuration change. Suped is our DMARC monitoring product. For most teams, it is the best overall practical choice here because it detects authentication issues automatically, identifies the affected source, and gives specific steps to fix the failure.
- Watch DKIM pass rates. Alert when Simplelists volume starts failing DKIM or the signing domain changes.
- Separate expected SPF noise. Treat unaligned SPF as expected only while DKIM and DMARC continue to pass.
- Detect unknown sources. Review new IP addresses and rDNS hostnames before classifying them as Simplelists traffic.
- Route alerts to owners. Send real-time alerts and weekly summaries to the people who control Simplelists and DNS.
- Keep one operational view. Use Suped to review DMARC, SPF, DKIM, blocklist (blacklist), and deliverability signals without manually reading XML reports.
Suped groups aggregate-report data by sending source and exposes verified and unverified traffic. That makes the action clear when a Simplelists selector stops working: confirm the affected domain, open the tailored fix steps, correct DNS, and verify the recovery against new reports.
Recommended alert conditions
- DKIM failure. Alert on any sustained failure for known Simplelists traffic.
- DMARC failure. Treat a DMARC pass-rate drop as urgent before increasing enforcement.
- New source. Review unfamiliar Simplelists-like rDNS rather than approving it by suffix alone.
- Record drift. Investigate DMARC, SPF, or DKIM DNS changes that were not scheduled.
Secure your domain with p=reject
Move to p=reject after every legitimate sender has a stable aligned path. For Simplelists, that means DKIM passes across normal postings, moderated mail, digests, and automated list messages. I do not wait for SPF alignment that the source cannot provide. I require DKIM and DMARC to stay healthy instead.
- Collect representative data. Observe at least two complete sending cycles and include low-frequency Simplelists messages.
- Classify every source. Mark Simplelists and every other legitimate system as authorized, then investigate all remaining volume.
- Fix DKIM consistency. Require Simplelists DKIM to pass for each From domain and each message type that subscribers receive.
- Stage quarantine. Use p=quarantine with a small pct value, monitor impact, then increase coverage after clean report cycles.
- Enforce reject. Publish p=reject at full coverage when legitimate mail consistently passes and unknown traffic has been resolved.
- Keep monitoring. Continue alerts after enforcement because a broken selector can cause valid list mail to be rejected.
Ready for enforcement
- Known traffic. Every source has an owner.
- Stable DKIM. Simplelists passes consistently.
- Clean reports. Legitimate failures are resolved.
- Active alerts. Breakage reaches the right owner.
Pause the rollout
- Unknown volume. Unclassified sources still send.
- Intermittent DKIM. Some Simplelists mail fails.
- Unowned DNS. No one can make a fast repair.
- Missing test paths. Digests or automated mail are untested.
Suped's hosted DMARC policy staging, automated issue detection, real-time alerts, and source-level reports make this rollout practical. Its unified view also covers SPF, DKIM, blocklist (blacklist), and deliverability signals. For agencies and managed service providers, the multi-tenant dashboard keeps separate client domains in one operational view.
Use hosted DMARC when policy changes need controlled staging without repeated manual TXT edits. It does not repair broken Simplelists DKIM, so complete the source-side fix before increasing enforcement.
Staged quarantine recordDNS
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com
Full reject recordDNS
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com
Simplelists authentication FAQ
These checks cover the Simplelists-specific points that most often affect enforcement and troubleshooting.
