Do I need to add Jotform to my SPF or DMARC record?

Which address does Jotform send from?

Sender Email - Lets you use your own SMTP server to send emails instead of Jotform's default [email protected].

Jotform says in its own documentation that this email comes from [email protected]. That is Jotform's own domain, so the email is checked against Jotform's records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is Jotform's, the check uses Jotform's records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

Can Jotform send from my own domain instead?

Sender Email - Lets you use your own SMTP server to send emails instead of Jotform's default [email protected].

Jotform lets you send these emails through your own SMTP server instead.

If you turn that on, the email is sent as your domain, and your SPF, DKIM and DMARC records then apply to it. Publish the records Jotform shows you before you raise your DMARC policy.

What should I watch for with Jotform email?

A forged email can copy the look of a Jotform message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.