Greatmail Email Authentication Guide: SPF, DKIM, And DMARC Setup

Key Takeaways

Direct Deliverability Impact: Correctly configuring SPF, DKIM, and DMARC prevents your business communications from getting marked as spam and ensures high inbox placement when utilizing Greatmail.
SPF Single-Record Rule: Never publish multiple SPF records on your domain. If you already have an existing record, merge include:spf.greatmail.com into it rather than adding a second TXT entry.
Account-Specific DKIM: Greatmail generates unique private keys and selectors for each domain. You must request your custom public key from Greatmail support during onboarding rather than guessing values.
Safe Staged Rollout: Always begin with a DMARC policy of p=none to safely monitor your outbound email streams before upgrading to strict enforcement (p=reject).

When your organization relies on Greatmail for email hosting or outbound SMTP services, your messages are dispatched through Greatmail’s specialized server infrastructure.

Without proper DNS authorization, mailbox providers (like Gmail and Yahoo) may view your emails as unauthorized spoofing attempts. Implementing an aligned SPF, DKIM, and DMARC policy bridges this trust gap, validates your brand identity, and secures your outbound mail.

Step 1: Request Domain Provisioning and Custom Keys

Because Greatmail coordinates unique selectors and key pairs on an account-by-account basis, you must gather your custom hosting parameters directly from your onboarding instructions or Greatmail support.

1. Submit Domain Setup: Register your exact sending domain with Greatmail during your onboarding process.

2. Define Your Service Type: Clarify whether your domain will be utilizing full Greatmail hosted mailboxes or if you are configuring outbound SMTP services only.

Important: If you only use Greatmail for SMTP-only outbound sending, do not change your MX records. MX records govern inbound mail. Only point your MX records to Greatmail (commonly smtp.greatmail.com with priority 10) if they are hosting your incoming mailboxes.

3. Request Your Custom Keys: Ask Greatmail to provide your account-specific DKIM Selector, DKIM Public Key, and verify if a custom, aligned Return-Path has been designated for your domain.

Step 2: Configure Greatmail SPF

SPF authorizes the sending mail servers that are allowed to send mail on behalf of your domain.

Scenario A: If you DO NOT have an existing SPF record

If your domain does not currently have an SPF record, publish a new TXT record within your DNS zone:

Type: TXT
Host/Name: @ (or leave blank for the root domain)
Value:

v=spf1 mx include:spf.greatmail.com ~all

(Note: We recommend utilizing ~all (soft fail) for your initial monitoring setup over the strict -all (hard fail) to prevent legitimate mail from bouncing while you align your sources).

Scenario B: If you DO have an existing SPF record (Most Common)

If you already send emails through other tools (such as Microsoft 365 or Google Workspace), never create a second SPF record. Doing so triggers a PermError immediately.

Instead, merge Greatmail’s include statement into your current record:

Before:

v=spf1 include:spf.protection.outlook.com ~all

After:

v=spf1 include:spf.protection.outlook.com include:spf.greatmail.com ~all

Adding multiple third-party sending platforms can push you past the standard 10-lookup DNS limit. You can monitor your lookup count using PowerDMARC’s SPF checker or bypass the limit entirely with Hosted SPF.

Step 3: Configure Custom DKIM

DKIM signs outgoing messages with a private key, which receiving servers then verify using the public key published in your DNS. Because Greatmail generates unique key pairs, do not copy another customer’s selector.

Using the exact selector and public key provided by Greatmail, create a new DNS record:

Type: TXT
Host Record / Name: [selector]._domainkey (replace [selector] with the specific string provided by Greatmail support)
TXT Value:

v=DKIM1; k=rsa; p=[Greatmail-public-key]

Note:When copying the public key, ensure you do not introduce accidental spaces or line breaks. Once published, confirm with Greatmail support that the record has propagated so they can toggle active signing on their servers. If you want to check your keys, you can do so by using PowerDMARC's DKIM checker.

Step 4: Configure Your DMARC Record

DMARC relies on the alignment of either SPF or DKIM to verify an email’s authenticity. For DMARC to pass, the domain in your visible “From” header must match the authenticated domain used in SPF (Return-Path) or DKIM (d= signing tag).

Use PowerDMARC’s free DMARC Record Generator to build your starting record.

1. Access your DNS settings and create a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

2. Save your new record.

By utilizing a p=none policy, you can safely monitor all sending sources in aggregate XML reports (rua) without risking delivery disruptions to your legitimate mail streams.

Step 5: Verify, Troubleshoot, and Enforce

To guarantee that your authentication is aligned, run a live test.

Test DNS Propagation: Use PowerDMARC’s DMARC Record Checker to verify that your SPF, DKIM, and DMARC TXT records resolve at their correct hostnames.

Send a Test Email: Send a live email through your Greatmail SMTP credentials using your production “From” address to a mailbox you control.

Inspect the Headers: View the raw message headers (e.g., “Show original” in Gmail) and check the Authentication-Results header:

Look for spf=pass and confirm the smtp.mailfrom domain aligns with your “From” domain.

Look for dkim=pass and confirm the d= tag matches your domain.

Verify that dmarc=pass is actively recorded.

Common Pitfall: If SPF passes for a Greatmail-owned return-path domain and DKIM passes for a Greatmail-owned signing domain, DMARC will still fail because neither domain aligns with your personal "From" domain. Ensure Greatmail has configured a custom aligned return-path and custom DKIM under your specific domain.

Safe Path to p=reject

Remain at a monitoring policy of p=none for one business cycle. This gives seasonal, transactional, and automated email streams plenty of time to show up in your reports. Once you have validated that all your authorized sending sources are passing aligned authentication, update your policy to quarantine and eventually to reject to prevent impersonation and spoofing:

Quarantine (Staging): v=DMARC1; p=quarantine; rua=mailto:[email protected];
Reject (Enforcement): v=DMARC1; p=reject; rua=mailto:[email protected];

Final Words

Ready to maximize your email security? The PowerDMARC team can help you confidently monitor your Greatmail traffic, transition safely to DMARC enforcement, and display your brand logo in customer inboxes with BIMI.

Reach out to our team or book a PowerDMARC demo today to secure your business communications!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Greatmail Email Authentication Guide: SPF, DKIM, and DMARC