Add SPF, DKIM & DMARC on GoDaddy, Namecheap, Cloudflare & Route 53
The DNS records FirstSales gives you are the same everywhere — only the registrar's UI differs. Cloudflare is one-click; here's where the TXT/CNAME fields live on each of the big four.
- 1
The records are the same everywhere
Start in FirstSales: Mailbox → Email Authentication. It shows your SPF (TXT), DKIM (TXT/CNAME, one or more selectors like
mail._domainkey), and DMARC (TXT) records, each with a host and a value. Copy these — they’re what you paste into any registrar. Don’t copy values from anywhere else; they’re generated per domain.
- 2
Understand host vs. value
Every record has a type (TXT or CNAME), a host/name (
@for the root domain, or a subdomain like_dmarcormail._domainkey), and a value. Registrars label these differently — Name/Host, Value/Content/Points-to — but they mean the same two fields. - 3
Cloudflare — one-click
If your domain is on Cloudflare, FirstSales detects it and offers a one-click modal: paste a scoped Zone › DNS › Edit token and it writes SPF/DKIM/DMARC for you. It’s the fastest path, and the token is single-use — never stored or logged. See Cloudflare one-click DNS.
- 4
Cloudflare — manual (if you prefer)
DNS → Records → Add record: set Type, Name (host), and Content (value). Leave the proxy set to DNS-only (grey cloud) for mail records — proxying breaks them.
- 5
GoDaddy
Domain → DNS → Manage Zones/Records → Add. Map: Type = TXT/CNAME, Name = the host (use
@for root), Value = the FirstSales value. Save, and give it time to propagate. - 6
Namecheap
Domain List → Manage → Advanced DNS → Add New Record. Map: Type, Host = the host (
@for root), Value. Save. - 7
AWS Route 53
Hosted zones → your zone → Create record. Record name = host, Record type = TXT/CNAME, Value = the FirstSales value (wrap TXT values in quotes, as Route 53 expects). Save.
- 8
Add the tracking-domain CNAME, then verify
Add the one tracking-domain CNAME the same way, then return to FirstSales and re-check: statuses move from pending → CNAME OK → SSL OK → Verified, and the auth checks flip to green. Propagation can take minutes to hours — don’t re-add records while you wait.
Pro tips
Hard-won shortcuts that keep warm-up on track.
Always copy from your own screen
Copy the records from your Email Authentication screen — never from a tutorial. The DKIM selector and values are generated per domain and are unique to you.
Keep mail records DNS-only on Cloudflare
Proxying (orange cloud) breaks SPF, DKIM, DMARC, and tracking CNAMEs. Keep them set to DNS-only (grey cloud).
Different words, same two fields
Host/Name/Points-to/Content are just registrar-specific labels for the same host and value FirstSales shows you.
Don’t panic on Pending
DNS propagation takes minutes to hours after saving. Re-check the status ladder instead of re-adding records.
Frequently asked questions
Why do I need SPF, DKIM, and DMARC at all?
Without them, mailbox providers can’t verify your mail is really from you, so it lands in spam. They’re the foundation of deliverability.
Are the record values the same for everyone?
No. SPF/DKIM/DMARC values are generated per domain (DKIM even has a unique selector). Always copy from your own Email Authentication screen.
My registrar calls it ‘Name’ not ‘Host’ — same thing?
Yes. Name and Host are the same field; Value, Content, and Points-to are the same field. Use @ for the root domain.
I’m on Cloudflare — do I have to add records by hand?
No. Use the one-click modal with a scoped, single-use DNS token and FirstSales writes them for you. Manual works too, if you prefer.
Why is my record still ‘Pending’ after I saved it?
DNS propagation — it can take minutes to hours. Re-check the status ladder rather than adding duplicate records.
Do I need a DKIM record if I have managed DKIM?
Some connector types (password/relay) use managed DKIM and handle it for you — your screen will show that. Otherwise, add the DKIM record shown.
My mail still goes to spam after adding records — why?
The records may not have propagated or verified yet, or the issue is warmup or content instead. Confirm all statuses are green first, then see Emails landing in spam — the checklist.
Ready to put this into practice?
Start your FirstSales trial and launch a warmed, authenticated mailbox in minutes.
Start for $1