How To Set Up SPF, DKIM, And DMARC On Beehiiv [2026]

Connected a custom domain to Beehiiv or received a critical warning that DMARC authentication is required? Ensuring your newsletter’s deliverability remains pristine requires configuring your email authentication protocols properly.

Beehiiv handles SPF and DKIM uniquely through auto-generated CNAME records, but implementing DMARC remains a manual, mandatory step for all custom domains. This guide covers the exact configuration steps, platform-specific quirks, and how to verify that your setup is running perfectly.

Key Takeaways

Automated SPF & DKIM Generation: Beehiiv auto-generates SPF and DKIM as CNAME records during custom domain configuration. You copy them to your DNS provider instead of drafting raw TXT lines.
DKIM “Not Found” Delay: Seeing a “Not Found” status right after configuration is completely normal. Beehiiv’s DKIM verification requires outbound mail traffic to trigger detection.
Cloudflare Proxy Gotcha: If your DNS is managed via Cloudflare, ensure your authentication records are toggled to DNS Only. Beehiiv cannot detect or verify “Proxied” records.
72-Hour Cooldown: Domain propagation can take up to 72 hours. Avoid deleting and re-adding your records during this window to prevent getting rate-limited by Beehiiv’s SSL provider.

What Beehiiv Sets Up Automatically (And What You Still Need to Do)

When utilizing Beehiiv’s default subdomain infrastructure, email authentication protocols are entirely pre-configured. However, the moment you connect a custom domain, domain ownership authentication becomes your responsibility.

To protect your brand and improve placement:

Sender Policy Framework (SPF): Specifies which mail servers are authorized to send email on behalf of your domain. Beehiiv maps this via specialized CNAME keys.
DomainKeys Identified Mail (DKIM): Adds a cryptographic digital signature to your message headers, confirming the email was sent by you and untampered with in transit.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): Leverages SPF and DKIM states to provide enforcement actions (like reporting, quarantining, or rejecting unauthorized emails).

While Beehiiv organizes your custom domain mechanics using dynamic tracking entries, DMARC must be declared separately and manually by you within your domain registrar.

How to Add a Custom Domain and Set up SPF/DKIM Records

Step 1: Start the Custom Domain Setup

1. Log in to your Beehiiv dashboard.

2. Navigate to the bottom-left corner and click Settings.

3. Select the Domains tab, then locate and click the Set Up Custom Domain button.

4. Enter your root domain or chosen subdomain, establish your redirect preference (enabling a www redirect is highly recommended so your publication resolves consistently), and type in your designated sending domain.

Step 2: Review and Generate DNS Records

1. Advance to the Review and Set Up screen and confirm your domain properties are completely accurate.

2. Click Finish Set Up.

3. Beehiiv will instantly give you your unique DNS map. The system generates a complete stack of web, routing, and linkage records, of which 3 specific CNAME records are dedicated solely to provisioning your SPF and DKIM infrastructure.

Step 3: Choose Entri (Automated) or Manual Setup

Beehiiv allows two paths for writing records to your DNS provider:

Entri (Automated): If your domain provider is supported by Beehiiv’s automated partner, you can authorize Entri to securely sign into your registrar and write the generated records automatically. This option minimizes manual copy-paste errors.

Manual Setup: For unsupported registrars or administrators who prefer to restrict automated control panel access, you can copy each individual host and point-to value manually.

Step 4: Add the CNAME Records for SPF/DKIM

1. Log in directly to your domain registrar or external DNS host manager.

2. Create a new record entry for each of the three auto-generated Beehiiv authentication strings:

Type: CNAME
Host/Name: Paste the exact host key generated by Beehiiv (e.g., bh._domainkey). Note: Some DNS management panels require only the subdomain prefix; check your host’s formatting rules.
Target/Value: Paste the destination target string supplied by the panel.
TTL: Leave as Auto or 1 Hour.

3. Cloudflare Note: If your DNS runs through Cloudflare, toggle the Proxy Status for these records from Proxied (orange cloud) to DNS Only (grey cloud). Beehiiv cannot read records obscured by a proxy shield.

4. Save each record entry securely.

Step 5: Verify Your Changes

1. Return to your Beehiiv dashboard and click Verify Setup.

2. A successfully authenticated domain will display a verified checkmark with an “Email” status banner along the domain tier.

3. If it does not acknowledge validation immediately, allow time for global caching to settle. Propagation can take up to 72 hours. Do not modify, remove, or cycle records during this validation period, as this causes certificate rate-limit locks with Beehiiv’s SSL issuing service.

Step 6: Add the Beehiiv DMARC Record

To generate a proper, comprehensive DMARC record, you can use PowerDMARC’s free DMARC record generator.

1. Head to the DMARC Record Generator tool:

Here is what the new tags mean:

np (Non-Existent Subdomain Policy)

The np tag targets subdomains that return a DNS NXDOMAIN response (i.e., they do not exist).

t (Testing Mode)

The t tag has come to replace the pct (percentage) tag and makes it easier for you to test strict policies. What’s most important, t=y does not turn off your DMARC policy.

psd (Public Suffix Domain)

psd is used for the Organizational Domain during DMARC evaluation, mostly for Public Suffix Domains and custom domain hierarchies.

2. Select the p=none policy (i.e., only monitoring), to help you review your email traffic before you move to p=quarantine (soft enforcement) or p=reject (strict enforcement).

Note

Do not jump straight to p=reject, as it can block your own legitimate business emails. Always start with p=none instead. Only after you have verified and ensured that all legitimate senders are correctly configured can you move to stricter policies.

3. Add your email address to the Reporting field where you’d like to receive your DMARC rua aggregate reports.

4. Copy the DNS TXT record to then paste it into your DNS management console.

5. Head over to your DNS management console. Add the copied record:

Type: TXT
Host/Name: _dmarc (or _dmarc.yourdomain.com)
Value: [Paste the generated DMARC TXT value]

6. Save the record.

Cloudflare Note: If your DNS runs through Cloudflare, toggle the Proxy Status for these records from Proxied (orange cloud) to DNS Only (grey cloud). Beehiiv cannot read records obscured by a proxy shield.

Step 7: Verify Propagation

After saving, you can use the PowerDMARC DMARC Checker to confirm your new record is actively resolving globally.

The Phased DMARC Rollout

Do not jump straight into a restrictive execution policy. A proper DMARC strategy uses an intentional, phased progression to prevent blocking legitimate mail streams.

[Phase 1: Monitor (p=none)] ➔ [Phase 2: Quarantine (p=quarantine)] ➔ [Phase 3: Reject (p=reject)]

Phase	Policy Tag	Operational Impact
Weeks 1–4	p=none	Monitoring Mode: Collect XML diagnostic telemetry. Monitor your aggregate senders, confirm Beehiiv is operating cleanly, and resolve any source anomalies without affecting deliverability.
Weeks 5–8	p=quarantine	Soft Enforcement: Emails that fail authentication checks are automatically diverted away from the inbox into junk/spam folders. Use this period to verify no legitimate tools are broken.
Week 9+	p=reject	Full Enforcement: Malicious, unauthenticated, or spoofed email attempts masquerading as your domain are dropped outright at the receiving server gate.

Note: Raw DMARC XML data are structurally complex and hard to read manually. Processing your data feeds through our DMARC Analyzer Platform converts raw XML logs into an intuitive and human-readable dashboard, mapping clean pass/fail percentages across your entire sender profile.

Common Beehiiv Email Authentication Issues

DKIM Shows “Not Found” Right After Setup

Symptom: Your SPF and DMARC items show green checkmarks, but Beehiiv’s interface reports DKIM as missing or unverified.
Cause: Static DNS keys read instantly, but Beehiiv’s internal platform validates DKIM signatures dynamically by observing a signed mail envelope in transit. If your new custom domain has zero outbound history, there is no signal to evaluate.
Fix: Send a live test broadcast or set up an automated welcome sequence email to your own account. Once the mail system flags an active transaction, the interface status will update to active.

Domain Won’t Verify After Adding Records in Cloudflare

Symptom: Every record entry perfectly mirrors the data elements inside Beehiiv, yet validation checks repeatedly time out or fail.
Cause: Cloudflare’s standard proxy configuration hides structural DNS data behind its own edge optimization network.
Fix: Access your Cloudflare DNS console, click Edit on each of the 3 Beehiiv-pointing CNAME records, and shift the toggle from Proxied (orange cloud) to DNS Only (grey cloud).

Verification Stuck Beyond 72 Hours

Symptom: The domain processing state stays stuck on pending loop status well past the expected window.
Cause: This usually happens if you delete and re-add records during the initial propagation window, which triggers safety rate limits with Beehiiv’s automated backend SSL provider.
Fix: Leave all entries completely untouched. If validation is still frozen after 72 hours, use Beehiiv’s in-app chatbot helper to alert their engineering support desk.

Namecheap Private Email Conflict

Symptom: Your primary mailing workflows break or domain provisioning throws systematic hard stops exclusively on Namecheap-hosted domains.
Cause: Choosing the specific word mail as your structural sending subdomain (e.g., mail.yourdomain.com) triggers an architectural conflict with Namecheap’s Private Email server routing rules.
Fix: Choose a different variation for your newsletter sending subdomain prefix (such as news, letters, or send). Beehiiv’s validation system flags this specific hazard automatically during your initial setup steps.

DMARC Fails Even Though SPF and DKIM Pass Individually

Symptom: Deep message header analysis reveals individual spf=pass and dkim=pass logs, but the overall system flags a dmarc=fail error.
Cause: Alignment Failure. DMARC requires that the domain handling the SPF/DKIM authentication matches the root domain shown in the visible From: address field.
Fix: Confirm that your sending domain configuration within Beehiiv mirrors the domain identity displayed in your public campaign From: addresses.

How to Verify Everything Is Working

To confirm your email authentication setup is correct, complete these validation steps:

Test an Outbound Email Send: Dispatch a live test message from your Beehiiv account to an external inbox (like a personal Gmail address). Open the raw header view (“Show original” inside Gmail) and confirm that SPF: PASS, DKIM: PASS, and DMARC: PASS are clearly stamped inside the authentication block.
Run an SPF Record Lookup: Verify your public keys resolve cleanly without syntax formatting issues.
Run a DKIM Record Lookup: Ensure your cryptographic key configurations publish correctly across global name servers.
Run a DMARC Record Checker: Confirm your structural policy tags match your intended enforcement parameters.
Audit the Complete Domain Grade: Paste your root web address directly into the comprehensive PowerDMARC Domain Analyzer for an all-in-one diagnostic score covering your complete email security and authentication health.

Beehiiv Email Authentication Best Practices

Proactive Deployment: Always configure your SPF and DKIM records before scheduling your first major campaign blast to protect your initial sender reputation.
Never Skip DMARC: DMARC is a mandatory compliance requirement for all custom domains on Beehiiv. Skipping it can lead to deliverability problems or account non-compliance.
Avoid Enforcement Speed-Running: Never deploy a p=reject rule on day one. Transition your policies gradually through a monitored, phased rollout to avoid accidentally blocking your own legitimate emails.
Audit Future Sending Changes: If you migrate auxiliary platforms or introduce external transactional software to your domain down the line, re-verify your DNS setup to ensure these tools don’t conflict with your Beehiiv configuration.

Frequently Asked Questions

Does Beehiiv set up SPF and DKIM automatically?

Yes, but only if you use the default *.beehiiv.com subdomain. If you run your newsletter on a custom domain, Beehiiv auto-generates custom CNAME records that you must copy over and publish inside your domain’s DNS panel.

Is DMARC required on Beehiiv?

Yes. Since February 2024, Beehiiv enforces mandatory DMARC implementation for all custom domains to comply with email provider security standards and protect against domain spoofing.

Why does my Beehiiv DKIM record show as “Not Found”?

Unlike static records, Beehiiv verifies DKIM dynamically by checking real emails in transit. Simply send a quick test email or newsletter broadcast from your account to trigger verification.

How long does Beehiiv domain verification take?

It usually takes anywhere from a few minutes up to 72 hours for global DNS changes to fully propagate. Avoid changing or re-adding your records during this window to prevent security provider rate limits.

Can I use Beehiiv with Cloudflare DNS?

Absolutely. However, you must change the Proxy Status for your Beehiiv authentication CNAME records from Proxied (orange cloud) to DNS Only (grey cloud), or the validation checks will fail.

What DMARC policy should I start with on Beehiiv?

Always start with a monitoring-only policy (p=none). This lets you collect deliverability reports and fix any alignment gaps before safely moving to stricter enforcement policies like quarantine or reject.

About
Latest Posts

Ayan Bhuiya

Shift Lead, Infrastructure & Email Security Expert at PowerDMARC

With over 13 years of experience in Cyber Security, Ayan Bhuiya specializes in Infrastructure, Business Continuity, Risk Management, and Email Security. Currently acting as Shift Lead at PowerDMARC. He holds a Postgraduate Diploma in Networking and Security and has a proven track record of leading strategic security initiatives to mitigate threats and ensure business resilience.

How to Set Up SPF, DKIM, and DMARC on Beehiiv [2026]