How to set up DMARC/DKIM/SPF for Textmagic
Set up Textmagic by connecting a business domain, publishing every DNS record shown for that domain, and clicking Verify records. Then publish DMARC at _dmarc on the visible From domain. Textmagic supports a custom return-path domain, so SPF can pass with a domain match, while DKIM should also authenticate with your domain. Start new deployments at p=none, test a real campaign, and move to p=reject only after every legitimate source passes DMARC.
I keep the sender address and Reply-To address the same when practical, use a dedicated sending subdomain for campaigns, and warm new sending gradually. Textmagic's checklist also recommends branded domains, authentication, gradual warm-up, and permission-based lists.
Add your domain
Textmagic requires a domain that the business owns and controls. Free mailbox domains cannot be connected for bulk campaigns. I prefer a subdomain such as updates.example.com when campaign mail should have separate reputation from normal staff mail.
- Open settings: In Textmagic, go to Messaging settings, select Emails, and click Connect a new domain.
- Enter the domain: Enter the exact domain that will appear after the @ in the campaign From address, then click Continue.
- Choose authentication: Use automatic setup when Textmagic detects the DNS host, choose manual setup to copy records yourself, or send the instructions to the DNS administrator.
- Preserve existing mail: Do not remove MX, SPF, DKIM, or verification records used by normal mail or another approved sender.
Textmagic Emails settings with Connect a new domain highlighted
Automatic setup signs in to the detected DNS provider and adds the required records. Manual setup gives full control and is safer when change review is required. Both routes end at the same Textmagic verification check.
Automatic DNS setup
- Best fit: Use it when the detected DNS account contains the correct zone.
- Review access: Confirm the requested zone and records before authorising the change.
- Finish: Return to Textmagic and wait for each record to show as verified.
- Audit: Export or record the final DNS changes for future troubleshooting.
Manual DNS setup
- Copy exactly: Use every host, record type, value, and priority displayed by Textmagic.
- Avoid duplication: Check whether the DNS interface appends the zone name automatically.
- Keep DNS-only: Any mail CNAME must resolve directly and must not use an HTTP proxy.
- Verify again: Click Verify records after saving, then repeat after DNS propagation.
Textmagic domain authentication options for automatic and manual setup
After the domain verifies, add a sender under the same Emails settings area. Enter the mailbox prefix, From name, and Reply-To address. Textmagic can create separate sender profiles for different teams after the domain is approved.
Set up SPF
SPF authenticates the envelope sender, also shown as the Return-Path after delivery. Textmagic supports a custom return-path domain, so publish the return-path or bounce-domain records that its domain setup displays. Those records let SPF use a domain under the same organisational domain as the visible From address.
Do not invent an SPF include or copy Textmagic's corporate SPF record. The account-specific DNS screen is the source of truth. A domain can have only one SPF TXT record at a given hostname, so merge any supplied mechanism into the existing record only when Textmagic explicitly tells you to edit that hostname.
- Find the return path: Open the connected domain in Textmagic and identify the return-path, bounce, or SPF-related host.
- Publish each record: Add the exact TXT, CNAME, or MX record displayed, including any priority value.
- Check for two records: Query the same hostname and remove duplicate SPF policies before testing.
- Verify in Textmagic: Click Verify records and wait for the return-path record to report success.
Textmagic DNS authentication records with return-path verification status
Run the SPF check against the exact return-path hostname shown by Textmagic. Checking only the visible From domain can miss the policy that receivers actually evaluate.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
A good result has one valid SPF policy, no syntax error, no permanent DNS error, and no more than ten lookup-causing mechanisms. The record also needs to authorise the IP that Textmagic used for the test message.
After sending a campaign, inspect Authentication-Results. Look for spf=pass and confirm that the smtp.mailfrom domain shares the organisational domain used in the visible From address. That domain match gives DMARC an SPF pass.
Never publish a second SPF policy
Two SPF TXT records at one hostname cause a permanent error. Edit the existing policy when an include is required, or publish Textmagic's delegated return-path record at the separate host it specifies.
|
|
|
|---|---|---|
Policy count | One | Merge |
DNS lookups | Ten or fewer | Reduce |
SPF result | Pass | Verify host |
Domain match | Same org | Fix return path |
Compact SPF checks for a Textmagic sender
Set up DKIM
Textmagic generates the DKIM DNS entries for the connected domain. Publish every DKIM row it displays. The selector and target can differ between accounts, so copied values from another Textmagic customer will fail.
- Locate DKIM: Open the domain authentication records and find each host containing _domainkey.
- Copy all rows: Create each record with the exact type, host, and target or public-key value.
- Check the host: If the DNS console appends the zone, enter only the selector portion to avoid a duplicated domain.
- Remove proxying: Keep a DKIM CNAME as a normal DNS record so receivers can follow it.
- Activate signing: Click Verify records and wait until Textmagic marks every DKIM entry as verified.
Textmagic DKIM records marked as verified
A DNS query should return a DKIM public key directly or through the supplied CNAME. Replace the selector placeholder below with the selector shown in Textmagic.
Check the Textmagic DKIM selectorBASH
dig +short TXT selector._domainkey.example.com dig +short CNAME selector._domainkey.example.com
Send a real campaign after verification and inspect its DKIM-Signature header. The d= domain should be the connected domain or its subdomain, and Authentication-Results should show dkim=pass. A passing signature with a matching organisational domain can satisfy DMARC even if SPF alignment has an error.
A verified record is not the final test
DNS verification proves that Textmagic can see the key. Only a received campaign proves that Textmagic signed the message, the signature survived transit, and the signing domain matches the visible From domain for DMARC.
Set up DMARC
DMARC is published in DNS for the domain in the visible From address. It does not authorise Textmagic directly. It tells receivers how to evaluate matching SPF or DKIM results, where to send aggregate reports, and what to do when neither method passes with the required domain match.
Keep an existing p=quarantine or p=reject policy unless reports prove it is breaking legitimate mail. For a domain without DMARC, I start with the exact p=none record below and replace the example report mailbox with a monitored address.
- Check first: Query _dmarc.example.com and edit the existing DMARC record instead of adding a second one.
- Create the host: Add one TXT record at _dmarc for the exact domain used after the @ in From.
- Set reporting: Use a mailbox or reporting address that accepts aggregate XML reports.
- Preserve enforcement: If the current policy is quarantine or reject, keep that policy and validate Textmagic under it.
Starter DMARC recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
The DMARC record generator creates the record when reporting, subdomain policy, or stricter matching options need adjustment. Keep p=none during discovery, not as the permanent destination.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
The checker should find exactly one syntactically valid record at the expected hostname. Confirm that p and rua have the intended values and that the reporting destination is prepared to receive reports.
DMARC passes when either SPF passes with a matching envelope domain or DKIM passes with a matching signing domain. Configure both for Textmagic because forwarding often breaks SPF, while message modification can break DKIM.
Pass criteria for Textmagic
- Visible sender: The From domain is the business domain connected in Textmagic.
- DKIM result: The message shows dkim=pass with a matching d= domain.
- SPF result: The message shows spf=pass with a matching smtp.mailfrom domain.
- DMARC result: Authentication-Results reports dmarc=pass for the From domain.
Verify and troubleshoot
Textmagic can mark DNS records as verified before a real message proves end-to-end authentication. Create a small campaign, select the verified sender, and send it to a mailbox where the raw headers can be inspected.
- Build a test: Open Compose, choose Email, add one recipient, and select the new verified sender.
- Send real content: Use the same template, links, From domain, and routing planned for production.
- Read headers: Record the SPF, DKIM, and DMARC results plus smtp.mailfrom, header.d, header.from, and the sending IP.
- Check history: In Textmagic, open History, then Outbound emails, and confirm the recipient was accepted rather than bounced or rejected.
Textmagic email composer prepared for an authentication test
The email tester is the quickest end-to-end check. Send the Textmagic campaign to the generated test address, wait for processing, and review the authentication diagnosis against the exact message that Textmagic delivered.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
If SPF passes but its authenticated domain differs from the visible From domain, DMARC cannot use that SPF result. Textmagic supports return-path alignment, so reopen its DNS instructions and repair the custom return-path records.
If a source does not support a custom return path, SPF does not need to be added to the visible From domain. SPF alignment errors are expected in that case, and they are acceptable when DKIM consistently passes with the correct domain and DMARC reports pass. Textmagic does support the custom return-path route, so an SPF mismatch here has a fix.
Passing message
- SPF: Pass with a matching return-path domain.
- DKIM: Pass with a matching d= domain.
- DMARC: Pass against the visible From domain.
- Textmagic: Delivered status appears in outbound history.
Common failure
- SPF permerror: Remove duplicate policies or reduce DNS lookups.
- DKIM neutral: Correct the selector host or CNAME target.
- DMARC fail: Compare header.from with smtp.mailfrom and header.d.
- Still pending: Wait for DNS propagation, then click Verify records again.
Get alerted when it breaks
A one-time pass cannot detect a deleted DKIM CNAME, an expired delegated key, an SPF lookup overflow, or a new sender that fails DMARC. Suped is our DMARC and email authentication platform, and this is the workflow where it fits: continuous DMARC monitoring with source identification and steps to fix each issue.
- Route reports: Use the Suped reporting address in rua so aggregate DMARC XML becomes readable source data.
- Verify Textmagic: Mark the known Textmagic source only after its IP, DKIM domain, return path, and sending pattern match.
- Enable alerts: Trigger real-time notifications when failure volume crosses the threshold set for the domain.
- Review changes: Use weekly summaries to catch drift in Textmagic authentication before raising policy enforcement.
Suped also keeps SPF, DKIM, DMARC, blocklist and blacklist monitoring, and deliverability checks in one place. Automated issue detection turns a failing source into a concrete DNS or sender-side action instead of leaving the team to interpret raw XML.
Alert on a change, not every message
- Authentication drop: Alert when Textmagic's DMARC pass rate falls below its normal baseline.
- New source: Investigate unfamiliar IPs before treating them as part of Textmagic.
- DNS fault: Escalate SPF permerror, missing DKIM, and missing DMARC immediately.
- Volume shift: Compare unexpected spikes with a planned Textmagic campaign before approving them.
For agencies and managed service providers, Suped's multi-tenant dashboard applies the same Textmagic source review and alert policy across client domains without mixing their data.
Secure your domain with p=reject
Move to p=reject only when DMARC reports show that every legitimate Textmagic stream and every other approved sender passes through SPF or DKIM with the required domain match. A single successful test does not cover scheduled campaigns, regional infrastructure, or low-frequency operational mail.
I use at least one complete business cycle of representative DMARC data, including billing runs, password notices, newsletters, and seasonal peaks when applicable. Unknown sources must be identified before enforcement, not automatically approved.
- Inventory mail: List Textmagic plus every system allowed to use the organisational domain in From.
- Resolve failures: Fix legitimate SPF and DKIM domain mismatches, then retest the actual production path.
- Stage enforcement: Use quarantine as a controlled checkpoint when the organisation needs a lower-risk transition.
- Set reject: Change the policy only after legitimate unknown volume reaches zero and approved traffic remains healthy.
- Keep monitoring: Watch every deployment after reject because DNS and Textmagic configuration can change later.
Stay at p=none
- Unknown mail: A legitimate source still has no owner.
- Textmagic failure: Production messages intermittently fail DMARC.
- Partial cycle: Reporting has not covered low-frequency senders.
- No owner: Nobody is assigned to respond to authentication alerts.
Ready for p=reject
- Known sources: Every legitimate sender has an owner and purpose.
- Textmagic pass: Representative campaigns consistently pass DMARC.
- Complete cycle: Reports cover routine and low-frequency mail.
- Active alerts: Failures trigger an owned response process.
Enforced DMARC recordDNS
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Suped's Hosted DMARC workflow stages policy changes while reports and real-time alerts show whether Textmagic remains healthy. It reduces repeated DNS edits and keeps the path to p=reject tied to observed source data.
Do not weaken a working policy
If the domain already uses p=quarantine or p=reject, keep that policy. Correct Textmagic authentication under the existing policy unless verified evidence shows legitimate mail is being rejected.
FAQ
These checks cover the failure cases that usually appear after Textmagic's domain status first turns green.
