Skip to main content

About SPF, DKIM & DMARC

How TidyHQ authenticates outbound email

Updated over 2 weeks ago

SPF, DKIM and DMARC are all technologies by which inbox providers (like Gmail and Outlook) can verify that TidyHQ (or our service providers) are allowed to send email on your club's behalf.
​
From 2024 onwards, major inbox providers have mandated the use of these technologies as an anti-spam measure.

All three methods rely on publishing information on the Web via the Domain Name System (DNS), which is how the internet maps domain names (like tidyhq.com) to IP addresses (like 192.168.1.1).

If your club sends email via the default clubname.tidymail.co, or uses the latest version of Custom Domains, we take care of this for you. If you use old-style Custom Domains, we'll ask that you add these to your DNS records.
​

SPF: Sender Policy Framework

Not sunscreen - but almost as important. An SPF record tells the receiver which IP addresses are allowed to send email for the domain name(s) associated with your club.
​

This system is designed to allow for indirection, which in practical terms means that the records you or we put in DNS just point to those of our service providers Postmark and Mandrill.

DKIM: Domain Keys Identified Mail

With DKIM, the email sender places a public key in their DNS records, and mentions this key in the headers of each email. They then cryptographically sign the email with their private key to prove to the recipient that only they could have sent it.

DKIM records can also be set up directly (with information given by Postmark) or indirectly (so the recipient can look up the information from Postmark or Mandrill).

DMARC: Domain-based Message Authentication, Reporting, and Conformance.

DMARC tells receivers what to do when a message doesn't match the sender's published SPF and DKIM rules. Options include marking it as spam, treating it normally, or rejecting it outright.

DMARC records also include an address for recipients to report back to the sender - so we know what's getting through and if anyone is sending spam in our name!

The new system

If your club is using a default email domain or the new system, your DNS is hosted by us (using Amazon Route53). We automatically configure SPF, DKIM and DMARC records for you. Club email is sent and received via Postmark.

If you have a custom domain and need to add or edit other DNS records for it, we provide a way for you to log in and add/edit those records.

As an example, demo.tidyhq.com uses the new system:

  • SPF records are at bounces.demo.tidymail.co (which is a CNAME alias for a Postmark domain).

  • DKIM records are at 20240429061307pm._domainkey.demo.tidymail.co

    • Note that the domain key is derived from an arbitrary timestamp. To identify your own club's domain key, you might need to look at the headers of an email.

  • DMARC records are at _dmarc.demo.tidymail.co

The old custom domain system

If you're on our older-style Custom Mail Domain setup, your outbound emails are still being sent via Mandrill. We tell you what settings to use, but it's your responsibility to record them with your DNS provider.


If you are experiencing issues that none of our articles has helped you solve, please contact by clicking the button below:


​USEFUL LINKS:πŸš€

Don't have an account yet? SignUp now and get Pro Free for 30 DaysπŸš€

New to TidyHQ? Check out our Getting Started Collection🐣
Everything you need to know? please refer to TidyHQ Faq'sπŸ’¬
Looking for TidyHQ rates? talk to us to better understand our PricingπŸ’°
Building smarter membership-driven groups? Check out our blogπŸ“£
Anything related to help topics? please visit our Helpcenter🚨

CONNECT WITH US:πŸŒβ„’

Check out our Website
Like us on Facebook
Tweet with us on Twitter
Subscribe to our official Youtube channel

WANT TO KNOW MORE?πŸ”Ž

If you'd like to know more, chat with us in the Messenger! 😊

Did this answer your question?