What SPF, DKIM and DMARC records does AI agent email need?

By Naol Ketema, founder · 2026-10-21 · Markdown

Why agents need this at all

Receiving mail servers do not know or care that a message was written by an agent. They check whether the sending domain authorized the server that sent it, whether the message was signed by that domain, and what the domain's policy says about failures. Gmail and Yahoo require SPF or DKIM for all senders and DMARC for bulk senders. Without these records, agent mail is likely to land in spam or be rejected.

Two things are easy to conflate. Verification proves to your mail service that you control the domain. Deliverability records convince receiving servers to trust the mail. You need both.

SPF: who may send

SPF (Sender Policy Framework) is a TXT record on a domain listing the servers allowed to send mail for it. The receiver checks the connecting server's IP against the SPF record of the envelope sender domain (the Return-Path, also called MAIL FROM), not the From header the reader sees.

• A domain may have only one SPF record. If you already send from Google Workspace or another service, merge the include: entries into one record.
• SPF evaluation is limited to 10 DNS lookups. Each include counts, and too many includes cause a permanent error.
• ~all (softfail) is the common ending while you are setting up. -all (fail) is stricter.

DKIM: the signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The signature names a domain (d=) and a selector (s=), and the receiver looks up the public key at selector._domainkey.domain. If the body or signed headers were changed in transit, the check fails. DKIM survives forwarding better than SPF, which is why it carries most DMARC passes in practice.

DMARC: policy and alignment

DMARC is a TXT record at _dmarc.yourdomain.com. It does two things: it requires alignment, and it states a policy.

• Alignment means the domain that passed SPF or DKIM must match the domain in the visible From header. In relaxed mode, the default, a subdomain counts as a match (mail.example.com aligns with example.com). In strict mode, set with aspf=s or adkim=s, it must match exactly.
• A message passes DMARC if SPF passes and aligns, or DKIM passes and aligns. Either one is enough.
• p=none only monitors. p=quarantine asks receivers to send failures to spam. p=reject asks them to refuse failures.
• rua=mailto:... sets where aggregate reports go, so you can see who is sending as your domain and whether it passes.

Alignment is why sending through a third-party provider needs care. If the provider signs with its own domain and uses its own Return-Path, both checks can pass while DMARC still fails, because neither aligns with your From domain. Publishing the provider's DKIM record on your domain fixes this, since the signature then uses d=yourdomain.com.

What to set for agent mail with Agent Identity

On Agent Identity, add and verify the domain, then ask for its deliverability records. The response is tailored to the configured mail provider, because the records differ between providers.

curl -sS "https://api.agent-identity.dev/v1/domains/$DOMAIN_ID/deliverability" \
  -H "authorization: Bearer $AID_KEY"

{
  "provider_kind": "resend",
  "records": [
    { "purpose": "spf", "record_type": "TXT", "record_name": "yourdomain.com",
      "record_value": "v=spf1 include:amazonses.com ~all" },
    { "purpose": "dkim", "record_type": "TXT", "record_name": "resend._domainkey.yourdomain.com",
      "record_value": null },
    { "purpose": "dmarc", "record_type": "TXT", "record_name": "_dmarc.yourdomain.com",
      "record_value": "v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com" }
  ]
}

• SPF: publish the value returned. If the domain already has an SPF record, merge the include into it rather than adding a second record.
• DKIM: a null record_value means the value cannot be known from the API, because the provider generates a unique DKIM key per domain. The docs say to take that value from the provider's own dashboard.
• DMARC: start at p=none with a rua address you read. It monitors without rejecting anything.

Tightening DMARC safely

• Step 1: Publish p=none and collect aggregate reports for a few weeks.
• Step 2: Confirm every legitimate source of mail for the domain (agents, people, marketing tools, billing systems) passes SPF or DKIM with alignment.
• Step 3: Move to p=quarantine, optionally with pct= to apply it to a fraction of mail first.
• Step 4: Move to p=reject once reports stay clean.

Going straight to p=reject on a domain that is not fully set up is how you silently lose real mail. A common pattern is to give agents a subdomain such as agents.yourcompany.com with its own SPF, DKIM and DMARC, so agent sending cannot break the main domain's mail and its reputation is tracked separately.