Skip to main content
SPF authorizes servers for the envelope sender domain. DKIM signs a message with a domain’s key. DMARC checks whether a passing SPF or DKIM result aligns with the visible From domain. Configure all three for your sending domain and verify the result in received message headers.
DNS changes can affect every service sending for your domain. Preserve existing records and authorized senders. Ask your DNS administrator for help if you do not control the zone.

​
SPF record

Use the exact SPF value provided for your sender domain in the dashboard. If you already publish a v=spf1 TXT record at that name, merge the turboSMTP include into it before the final all mechanism. Publish only one SPF record per name. For a domain that sends only through turboSMTP, a minimal example is:
SPF record
Use include:spf.turbo-smtp.com, as documented in the turboSMTP knowledge base. It lists only turboSMTP’s sending ranges and costs one DNS lookup. Older guides show include:turbo-smtp.com, which is the company’s own domain record: it also authorizes Microsoft 365 servers and uses several lookups of the 10-lookup limit. Do not add both. The ?all example gives a neutral result for unlisted servers. Preserve your existing policy unless you intend to change it. Add a or mx only if those hosts also send mail for this domain. Keep the full policy within SPF’s ten DNS-lookup limit. See RFC 7208.

​
DKIM record

Copy the DKIM key shown for your sending domain in the dashboard. The documented selector is turbo-smtp. For yourdomain.com, its DNS name is turbo-smtp._domainkey.yourdomain.com. The published shared key is shown below as a reference. Confirm it against the dashboard before publishing it:
DKIM record
Some DNS editors append your zone name automatically. Enter either the relative host or the full name as your provider requires, without duplicating the domain suffix.

​
DMARC record

Start with a monitoring policy if you have not yet checked all legitimate senders. This record requests no special handling of DMARC failures:
DMARC record
p=none does not request aggregate reports by itself. To receive them, add rua=mailto:dmarc-reports@yourdomain.com using a mailbox or reporting service you control. Reporting to a different domain can require additional DNS authorization. After confirming that legitimate mail passes DMARC, consider p=quarantine or p=reject. DMARC passes when either SPF or DKIM passes with the required domain alignment; a passing check for an unrelated provider domain is insufficient. Receivers still apply their own filtering. See the DMARC standard.

​
Sending from a subdomain

For a sender such as noreply@mail.yourdomain.com, publish the SPF record at the envelope sender domain and the DKIM key below the signing domain. In turboSMTP’s authenticated sending mode these use the sender domain. Check the actual Return-Path and DKIM d= values in a received message. The dashboard’s DKIM host turbo-smtp._domainkey is relative to the sender domain. In a DNS zone for the root domain, include the sending subdomain label. For mail.yourdomain.com in the yourdomain.com zone: SPF is not inherited from the root domain. Add the dashboard-provided turboSMTP include to the subdomain’s own SPF record, preserving other authorized senders. DMARC can inherit a parent policy; check the effective policy before adding a separate record. For mail.staging.yourdomain.com, use mail.staging for SPF and turbo-smtp._domainkey.mail.staging for DKIM in the root zone.
An empty DKIM result can mean the key was published at the root-domain selector instead of the sending subdomain.

​
Verify your records

Return to the domain authentication settings in the dashboard after publishing DNS. Complete verification and check that authenticated sending is enabled. Publishing a record alone does not confirm the account’s sending mode. Use the DNS analyzer to inspect records with DKIM selector turbo-smtp. Then inspect a received test message for SPF, DKIM, DMARC, and alignment results. DNS caches can retain old values until their TTL expires.

​
What if I can’t edit my DNS?

Ask the DNS administrator to add the records or use a sending domain you control. A subdomain still requires DNS access or delegation. turboSMTP can use re-enveloped sender mode for an unverified domain. The envelope sender and signing domain may then be provider-controlled. This does not establish DMARC alignment with your visible From domain, and it does not guarantee delivery. Verify your domain before relying on it for production mail.

​
Benefits of configuring authentication

Authentication helps receivers identify authorized sending and detect spoofing. A tested DMARC enforcement policy can request quarantine or rejection of mail that fails alignment. Neither authentication nor a DNS analyzer result guarantees inbox placement.