SPF, DKIM and DMARC

When mxHERO processes a message, it changes the content and becomes another server in the delivery path. This page explains how to keep SPF, DKIM and DMARC passing so that processed mail isn't marked as spam or rejected. Set this up before you route production mail through mxHERO.

Before you begin

• Access to your DNS for every domain you route through mxHERO.
• Your routing design. Which steps you need depends on whether mxHERO delivers outbound mail directly or relays it back through your mail platform. See Routing architectures.
• Microsoft 365 only: Exchange administrator rights for the ARC step.

What changes when mxHERO is in the path

• SPF checks the IP address that delivers a message. When mxHERO delivers your outbound mail straight to recipients, the mail comes from mxHERO's IP addresses, so your SPF record must include mxHERO.
• DKIM signatures cover the message content. When a rule replaces attachments or the body, the original signature no longer matches. Messages need a new signature from mxHERO or from your mail platform.
• ARC records the SPF, DKIM and DMARC results a message had when it reached mxHERO. mxHERO adds an ARC seal (d=mxhero.com) to every message it delivers, so the next server can trust those original results.
• DMARC passes when SPF or DKIM passes and matches the domain in the From address. The steps below keep at least one of them passing in each direction.

Add mxHERO to your SPF record

1. Find the existing SPF record for your domain. It is a TXT record at the domain itself that starts with v=spf1.

2. Add include:_spf.mxhero.com before the final ~all or -all. Keep your existing entries. Examples:

   ; Microsoft 365
   example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:_spf.mxhero.com ~all"
   
   ; Google Workspace
   example.com.  TXT  "v=spf1 include:_spf.google.com include:_spf.mxhero.com ~all"
   
   ; Other mail platforms: add the include to your existing record
   example.com.  TXT  "v=spf1 <your existing entries> include:_spf.mxhero.com ~all"

3. Save the record. Repeat for every domain and alias you route through mxHERO.

Important: A domain must have only one SPF record. Merge the include into your existing record instead of adding a second v=spf1 record. Note the underscore: include:mxhero.com without _spf. does not work.

Check SPF in the dashboard

1. Open Settings › Organization and domains, then the Domains tab.
2. Find the SPF status for your domain. SPF is set means a record with include:_spf.mxhero.com was found. The link icon next to the status opens help on setting up SPF.
3. If you just changed DNS, check again later. DNS changes can take time to propagate.

Set up DKIM signing

mxHERO can sign mail from your domain with its own DKIM key, which you publish in your DNS. Do this if mxHERO delivers outbound mail directly to recipients. If mxHERO relays outbound mail back through Google Workspace (smtp-relay.gmail.com), Google signs it on final delivery.

1. Open Settings › Organization and domains, then the DKIM tab.

2. Click Setup DKIM....

3. Select the domain or alias, then click Continue.

   mxHERO creates a key pair and shows the DNS record to create.

4. In your DNS, create a TXT record with the name and value shown:

   mxhero._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=<public key from the dashboard>"

   The selector is mxhero for a domain's first key. Later keys use mxhero- plus four random characters, so a new key never overwrites the record of the key in use.

5. Wait for the record to propagate, then click Verify.

   mxHERO starts signing mail from that domain only after verification succeeds.

Repeat for each domain and alias that sends mail through mxHERO.

Rotate or remove a DKIM key

• Rotate: set up a new key for the domain, publish its record, and verify it. When the new key is verified, mxHERO deletes the old key and signs with the new one. You can then delete the old DNS record.
• Remove: delete the key on the DKIM tab. If the key was verified, signing stops immediately.

Only one unverified key can exist per domain at a time. Verify or delete it before you set up another.

Trust mxHERO as an ARC sealer

Microsoft 365

Tell Microsoft 365 to trust ARC seals from mxHERO, so that it uses each message's original authentication results instead of failing it for coming from mxHERO's IP addresses. The Office 365 Configuration Service does this for you. To do it yourself:

1. In the Microsoft Defender portal, open Email & collaboration › Policies & rules › Threat policies, then the email authentication settings, or go directly to https://security.microsoft.com/authentication?viewid=ARC.
2. On the ARC tab, add mxhero.com as a trusted ARC sealer, and save.

Or use Exchange Online PowerShell:

# Check existing trusted sealers first
Get-ArcConfig | Select-Object Identity, ArcTrustedSealers

# Add mxhero.com; include any sealers you already trust, separated by commas
Set-ArcConfig -Identity Default -ArcTrustedSealers "mxhero.com"

Warning: Set-ArcConfig replaces the whole list. If you already trust other sealers, include them, for example "mxhero.com,example-gateway.com".

Also add mxHERO's IP addresses to your connection filter allow list. ARC reputation builds over time, and the allow list protects delivery from the first day. See Network endpoints and IP addresses.

Google Workspace

No ARC setting is needed. Gmail evaluates ARC seals from intermediaries automatically. Add mxHERO's IP addresses to the Inbound gateway setting, as described in Google Workspace configuration.

How this affects DMARC

If your domain has a strict DMARC policy (p=quarantine or p=reject), route a pilot group first, and check the authentication results on test messages before you widen the scope.

Verify

Send test messages in each direction and open the full headers of the delivered messages.

• An ARC-Seal header with d=mxhero.com shows that mxHERO processed the message.
• In Microsoft 365, the Authentication-Results header should show compauth=pass. reason=130 means Microsoft accepted the result through the trusted ARC sealer.
• On outbound mail received by an external mailbox (for example a personal Gmail account), spf=pass, dkim=pass and dmarc=pass should appear in the authentication results.

Troubleshooting

Related pages

• Network endpoints and IP addresses
• Organization and domains
• Office 365 manual configuration
• Spam and authentication issues