Gorelo DKIM, DMARC & SPF Setup Guide

Key Takeaways

Retain the gorelo. subdomain. When Gorelo generates your DNS records, they will include a specific gorelo subdomain label in the hostname. Do not remove this, or your verification will fail.
Records are account-specific. Gorelo generates unique Return-Path and DKIM values for every account. You must copy these directly from yo ur Gorelo portal rather than guessing generic values.
Merge SPF carefully. If you have an existing SPF record, add Gorelo’s provided include mechanism to it. Never create a second SPF TXT record.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a strict enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to instantly verify your DNS configurations are live and functioning correctly.

If you’re using Gorelo to manage your MSP ticketing, alerts, and billing emails, and haven’t set up custom domain authentication yet, this guide will walk you through the full process.

Setting up proper email authentication (SPF, DKIM, and DMARC) is vital for Gorelo users. These three protocols work together to protect your domain from spoofing, improve email deliverability, and ensure your critical service desk replies safely land in your clients’ inboxes rather than getting flagged as spam.

Why Authenticate Your Domain for Gorelo?

Gorelo is a comprehensive IT service delivery platform designed to help Managed Service Providers (MSPs) track tickets, manage remote systems, and communicate with clients.

When you accurately configure the necessary security protocols for Gorelo’s outbound emails, you will see immediate benefits:

Stronger Protection: Safeguards your MSP brand from phishing and spoofing, securing the trust of your clients.
Increased Deliverability: Ensures major mailbox providers trust your emails, keeping vital support replies and billing notices out of the spam folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email ecosystem networks.
Actionable Visibility: Grants useful, transparent insights into who is sending emails on behalf of your domain.

Steps to Configure Gorelo SPF and DKIM Records

To begin, you will need access to your Gorelo dashboard and your domain’s DNS management console.

Step 1: Generate Your Custom Records in Gorelo

Before updating your DNS, you must generate the correct hostnames and values inside Gorelo.

1. Log in to your Gorelo account.

2. Navigate to Settings —> Email —> Settings.

3. Click the Add Domain button in the top-right corner.

4. Enter your custom domain name (the one you want clients to see in the “From” address) and save.

5. Gorelo will now display a table of DNS records required for your domain. Keep this window open.

Step 2: Add the DKIM CNAME Records to Your DNS

Head over to your DNS provider (e.g., Cloudflare, GoDaddy, Route 53) where your domain is managed. You will need to create the CNAME entries provided by Gorelo to handle DKIM encryption.

Type: CNAME
Host/Name: Copy the exact selector hostname provided by Gorelo (e.g., s1._domainkey.gorelo.yourdomain.com).
Target/Value: Paste the exact target URL provided by Gorelo.

Note: Most DNS systems auto-append your root domain name, meaning you may only need to enter s1._domainkey.gorelo in the Host field depending on your provider. Ensure you do not accidentally duplicate your domain name, but do not remove the gorelo label either.

You can check the record itself with PowerDMARC’s DKIM checker.

Step 3: Add the SPF Record to Your DNS

Next, locate the SPF or Return-Path record generated in the Gorelo table.

If you do not have an existing SPF record, create a new TXT record:

Type: TXT
Host/Name: @ (or your root domain)
Value: Use the exact value provided by Gorelo (e.g., v= spf1 include:mailgun.org ~all)

If your DNS already has an SPF record for other services like Google Workspace or Microsoft 365, do not create a new one. Simply add the Gorelo include statement to your existing record right before the ~all tag.

Example: v=spf1 include:_spf.google.com include:[gorelo_value] ~all

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Steps to Enable Gorelo DMARC Record

Gorelo correctly advises using relaxed alignment (adkim=r and aspf=r) for DMARC, but if you don’t have a DMARC record published at all, you are leaving your domain vulnerable to impersonation and flying blind on deliverability errors.

Instead of a basic setup, we are going to generate a proper, comprehensive record using PowerDMARC’s free DMARC record generator.

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. For the Policy, select p=none (monitor-only mode). This ensures nothing gets blocked initially, allowing you time to safely review your email traffic before moving to enforcement.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who i s sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

Important: Jumping straight to enforcement risks blocking your own legitimate MSP ticket replies. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely.

1. Add your dedicated IT email address to the Reporting field to receive your DMARC aggregate reports (rua).

2. Log in to your DNS management console and add a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save the record.

Verify Your Setup

Step 1: Verify in Gorelo

Head back to your Gorelo account (Settings —> Email —> Settings). Once you have added all the DNS records to your provider, click the Verify button. Wait for all rows to show as successfully verified.

If it fails initially, don’t panic! DNS propagation can take anywhere from a few minutes to 24 hours. Refresh or check back a bit later. Once verified, you can test it by sending an email from an unrelated account to your Gorelo forwarding address and replying to it.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your configuration is fully accurate and active, follow these verification steps:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly.

What to expect in your domain health results:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

For more information, you can head to Gorelo’s support centre.

Final Words

If you want to take your email security further and move securely from p=none to DMARC enforcement, configure BIMI so your MSP logo displays in your clients’ inboxes, and monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Ayan Bhuiya

Shift Lead, Infrastructure & Email Security Expert at PowerDMARC

With over 13 years of experience in Cyber Security, Ayan Bhuiya specializes in Infrastructure, Business Continuity, Risk Management, and Email Security. Currently acting as Shift Lead at PowerDMARC. He holds a Postgraduate Diploma in Networking and Security and has a proven track record of leading strategic security initiatives to mitigate threats and ensure business resilience.

Gorelo DKIM, DMARC, and SPF Setup Guide