Do I need to add Stripe to my SPF or DMARC record?

Which address does Stripe send from?

By default, when Stripe sends invoices, receipts, and failed payment notifications to your customers, it sends them from the `stripe.com` domain. You can change this to a custom domain.

Stripe says in its own documentation that this email comes from stripe.com. That is Stripe's own domain, so the email is checked against Stripe's records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is Stripe's, the check uses Stripe's records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

Can Stripe send from my own domain instead?

To start sending emails from your own domain, complete the following steps:

Stripe can send these emails from your own domain once you publish the DNS records it gives you.

Stripe shows the DNS records to publish in the Dashboard.

If you turn that on, the email is sent as your domain, and your SPF, DKIM and DMARC records then apply to it. Publish the records Stripe shows you before you raise your DMARC policy.

Stripe asks for a DMARC policy on the domain before it sends customer emails from it.

Stripe does not support strict SPF alignment, so the DMARC record must not contain aspf=s.

Stripe suggests starting with p=none to watch what happens, then moving to quarantine or reject.

What should I watch for with Stripe email?

A forged email can copy the look of a Stripe message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.