How do I set up Omnisend so its email passes DMARC?
Publish the records Omnisend shows in your account for your domain.
Last read from the sources at the foot of this page.
What does Omnisend ask me to publish?
To add SPF and DKIM records , choose the domain name you'd like to use. We recommend using your store's domain (e.g., yourstore.com ). You'll need to add the provided records to your domain's DNS.
Omnisend makes the values for your account, so we do not print any here.
Where in Omnisend are my values shown?
To add a new domain, go to Store settings → Domains → Add domain .
In Omnisend, go to Store settings, then Domains, then Add domain.
Copy each value from there exactly as shown, and add each record at your DNS host.
How do I add Omnisend to the SPF record I already have?
SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".
Add the include Omnisend shows you inside the one SPF record you have, before its last word, and keep every service already in it. Never add a second SPF record: two make the check fail for every message.
An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10, the check fails, so remove services you no longer use before you add a new one.
Will p=reject block Omnisend email?
In Omnisend, we advise setting DMARC to p=none with SPF and DKIM alignment=relaxed .
Not once Omnisend signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Omnisend gives you are on your domain.
Omnisend advises a DMARC policy of none with relaxed alignment.
A valid DMARC record on the main domain is inherited by its subdomains unless you set a different one.
Omnisend also asks that your domain has a DMARC record. A domain has one DMARC record: if you have one, keep it and do not add another.
Before you raise your policy, read your DMARC reports and check that email from Omnisend passes.
Where does this come from?
- Omnisend: Set Up SPF, DKIM, and DMARC for Email Authenticationsupport.omnisend.comRead 14 October 2026
- Omnisend: Walkthrough: Implement 2024 Email Sending Rulessupport.omnisend.comRead 14 October 2026
- RFC 7208, Sender Policy Frameworkrfc-editor.orgRead 14 October 2026
- RFC 7489, DMARCrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/