How to set up SPF, DKIM and DMARC with Mailjet

Mailjet authenticates sending domains through its account's Domain & DKIM settings, which combines an SPF include instruction with an account-specific DKIM record.

SPF with Mailjet

Add Mailjet's include to your domain's single SPF TXT record:

yourdomain.com.    TXT    "v=spf1 include:spf.mailjet.com ~all"

If other senders already use this domain, merge rather than duplicate:

yourdomain.com.    TXT    "v=spf1 include:spf.mailjet.com include:_spf.google.com ~all"

How SPF works here

SPF checks the envelope sender domain (the MAIL FROM address used in the SMTP transaction, not necessarily the visible From: header) against the list of IPs/includes authorised in that domain's SPF record. Mailjet sends on your behalf from its own IP ranges, and the include:spf.mailjet.com mechanism authorises those ranges for your domain.

Setting up DKIM with Mailjet

In Mailjet's dashboard, under domain settings, add your domain and it generates a DKIM record specific to your account:

mailjet._domainkey.yourdomain.com.    TXT    "k=rsa; p=<account-specific-public-key>"

The selector Mailjet uses is commonly mailjet, but the public key value is unique to your account - copy it exactly from the panel rather than typing it by hand, since a single transcription error invalidates the entire key.

How DKIM works here

Mailjet signs each outgoing message with the private half of this key pair. The receiving server looks up the public key at the DNS location indicated by the selector and domain in the signature header, and verifies the message body and specified headers haven't been altered since signing.

Configuring DMARC

Mailjet doesn't publish this for you - add it directly:

_dmarc.yourdomain.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

How DMARC works here

DMARC doesn't introduce a new check - it tells receiving servers what to do based on the existing SPF and DKIM results, and crucially requires that whichever one passes also be *aligned*: the domain SPF or DKIM authenticated must match (or be a subdomain of) the domain shown in the visible From: header. Mailjet's DKIM signs with your own domain, so once that record verifies, DMARC alignment for DKIM is satisfied.

Advanced settings worth knowing

• Dedicated IP customers on Mailjet may have additional IP-specific SPF considerations - check your account's sending IP documentation if you're on a dedicated plan rather than shared infrastructure.
• Multiple subdomains: if you send transactional mail from a different subdomain than marketing mail, each needs its own DKIM selector verification, though they can share one root-domain SPF and DMARC record (DMARC checks the organizational domain by default unless sp= is set differently).

Troubleshooting common issues

• DKIM shows "pending" in Mailjet: DNS propagation delay is the most common cause - re-check after an hour.
• SPF passes, DMARC fails: check alignment - confirm the visible From: domain matches your domain, not a Mailjet-branded sending address.

What not to do

• Don't publish the DKIM TXT record with extra quote marks or line breaks introduced by your DNS panel - paste exactly what Mailjet shows.
• Don't leave two separate v=spf1 records in place after adding Mailjet's include - merge into one.

Mailjet authentication quick reference

FAQ

Does Mailjet support dedicated IP addresses, and does that change SPF setup? Dedicated IP customers still use the same include:spf.mailjet.com mechanism in most cases, since the include resolves to Mailjet's current IP ranges including dedicated pools - check your account's sending documentation if you're unsure which pool you're on.

What if I'm sending transactional mail from a different subdomain than marketing mail, both through Mailjet? Each subdomain used as a distinct From: identity should have its own verified DKIM configuration in Mailjet, though a single root-domain SPF and DMARC record generally covers both unless you deliberately set a different sp= policy for one of them.

My SPF passes in testing but Mailjet's own dashboard still shows it as unverified. Mailjet's own verification check and a direct dig lookup sometimes disagree briefly due to caching on either side - trust the direct dig result and recheck Mailjet's dashboard after a short wait.

MailPilot checks SPF, DKIM, and DMARC alignment for every mailbox domain it warms, including those sending through Mailjet, and tracks daily reputation

Does Mailjet offer its own DMARC monitoring dashboard, or do I need a separate tool? Mailjet's platform focuses on SPF and DKIM setup; ongoing DMARC aggregate report monitoring typically requires either manually parsing the XML reports or a separate dedicated DMARC monitoring service.

Does Mailjet's DKIM selector ever change without warning? Selector changes typically only happen if you regenerate authentication for the domain inside Mailjet's dashboard - routine sending doesn't rotate it automatically, so an unexpected DKIM failure is more likely a DNS or propagation issue than a silent selector change. so an alignment gap shows up as a specific failing check rather than a slow decline in placement.