Learn · Email authentication

Squarespace SPF Record & DMARC: How to Set Up Email Authentication

Squarespace Email Campaigns works differently from most providers: Squarespace no longer requires an SPF record for campaigns, and adding one won't change how your mail is judged. The path to a passing DMARC is DKIM plus a DMARC record of your own. Here's what to publish, what to skip, and why.

Squarespace SPF record — do you need one?

For Email Campaigns: no. Campaign mail is sent from Squarespace's own infrastructure with a Return-Path on Squarespace's domain, so your SPF record isn't even evaluated for it — and their current guidance dropped the SPF requirement entirely. Adding include:squarespace-mail.com to your SPF harmlessly covers their servers, but it's not what makes campaigns pass DMARC.

If your domain also sends real mail through Google Workspace, Microsoft 365 or another service, add their include instead — for Google:

v=spf1 include:_spf.google.com ~all

If you already have an SPF record, merge the includes into one record and keep the total under 10 DNS lookups.

Squarespace DKIM

This is the piece that matters. In Email Campaigns, verify your custom domain (the setting that also unlocks sending from your own address). Squarespace sets up DKIM signing for your domain as part of that verification, so campaign mail arrives signed — and aligned to you, not to Squarespace. That alignment is what DMARC checks.

Squarespace DMARC record

Add a TXT record named _dmarc in your domain's DNS settings — in the Squarespace Domains panel if your DNS is hosted there, or at your external DNS provider otherwise. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Read the aggregate reports for a week or two. Once every sender listed is one you own, enforce:

v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com; sp=reject; adkim=s; aspf=s

Squarespace runs p=reject on its own domain, so the policy is proven on their infrastructure too.

What changes in your reports

Before: campaign mail passes SPF and DKIM — but for squarespace-mail.com, so DMARC fails alignment and you stay unprotected. After domain verification and a DMARC record: campaigns pass for your domain, and your reports list only senders you own.

Done? Run the free DMARC checker — it reads your live DNS and confirms your records parse and align. For the staged walk from p=none to p=reject, see DMARC policies explained.