Moloni DKIM, DMARC & SPF Setup Guide

Key Takeaways

You need a Pro Plan. Moloni only allows custom domain sender configuration if your account is on their “Plano Pro” (Pro Plan).
Add Moloni’s IP addresses to your SPF. You will need to explicitly include Moloni’s two IPv4 addresses (94.46.130.39 and 94.46.130.38) in your DNS TXT record to authorize their servers.
Publish Moloni’s DKIM TXT Record. Moloni uses the default selector dkim for its signing. You must publish their provided public key as a TXT record in your DNS.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a strict enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to instantly verify that your DNS configurations are live and functioning correctly.

If you’re using Moloni as your primary invoicing and billing software to send documents and notifications to your clients, setting up proper domain authentication is crucial to ensure those important financial messages don’t end up in the spam folder.

Configuring proper email authentication (SPF, DKIM, and DMARC) ensures your domain is protected from spoofing and guarantees that your invoices safely land in your customers’ inboxes while meeting the strict requirements of major mailbox providers like Gmail and Yahoo.

Why Authenticate Your Domain for Moloni?

Moloni is an innovative commercial management and billing software used by thousands of companies to handle their daily invoicing.

When you accurately configure the necessary security protocols for Moloni, you will see immediate benefits:

Stronger Protection: Safeguards your domain from phishing and spoofing, which is especially critical for financial and billing communications.
Increased Deliverability: Ensures strict mailbox providers trust your emails, keeping your invoices, receipts, and account alerts out of the junk folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email networks.
Actionable Visibility: Grants transparent insights into who is sending emails on behalf of your business domain.

Steps to Configure Moloni SPF and DKIM Records

To begin, you will need access to your domain’s DNS management console and be prepared to contact Moloni support.

Note: Ensure you are subscribed to Moloni’s Pro Plan. If you use a free email provider like Gmail or Hotmail, you cannot configure custom authentication, and Moloni will force your emails to send via [email protected].

Step 1: Add the SPF Record to Your DNS

Head over to your DNS provider (e.g., Cloudflare, GoDaddy, Namecheap) where your domain is managed, and access your DNS settings.

To authorize Moloni, you must add their specific IP addresses: +ip4:94.46.130.39 and +ip4:94.46.130.38.

If you do not have an existing SPF record, create a new TXT record:

Type: TXT
Host/Name: @ (or your root domain)
Value: v=spf1 +a +mx +ip4:94.46.130.39 +ip4:94.46.130.38 ~all

If your DNS already has an SPF record for other services (like Microsoft 365 or Google Workspace), do not create a second one. Simply merge the IP addresses into your existing record right before the ~all tag.

Example: v=spf1 include:_spf.google.com +ip4:94.46.130.39 +ip4:94.46.130.38 ~all

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Step 2: Add the DKIM TXT Record to Your DNS

Moloni signs outbound emails using a specific RSA key associated with the selector dkim. In your DNS management console, create a new record with the following details:

Type: TXT

Host/Name: dkim._domainkey (Note: depending on your DNS host, you may need to enter dkim._domainkey.yourdomain.com)

Value:

v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYs9Oepmx+l9Kx0SGr+8wKNsqbqy5bsKEBfeZXaDks0PqWmvQlMGzvqk60thSW2YyCuMQ2rF96spCmRmEZT43eRWynuNRAQS9uacTHCQ/D/P9z1Mqu/WFawLh3p+k3JzYUeRZMwVg5Ol0nPOVBICbnOX1wJJzY1bmu0HHpGT55uQIDAQAB

Important Note on DKIM Keys:Email service providers periodically rotate their DKIM public keys for security purposes. Before publishing this exact value, we highly recommend double-checking Moloni's official server configuration guide or confirming with their support team ([email protected]) to ensure this key is currently active and hasn't been rotated.

You can check the record itself with PowerDMARC’s DKIM checker.

Steps to Enable Moloni DMARC Record

You should ensure you have a DMARC record published. Without reporting enabled, you won’t know if your billing emails are failing authentication or if bad actors are spoofing your brand.

Instead of guessing, use PowerDMARC’s free DMARC record generator to create a comprehensive record.

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. For the Policy, select p=none (monitor-only mode). This ensures nothing gets blocked initially, allowing you time to safely review your email traffic before moving to enforcement.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

Important: Jumping straight to enforcement risks blocking your own legitimate business emails. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. However, staying at p=none for too long is not recommended as it leaves your domain vulnerable to phishing and impersonation threats. Move to an enforcement policy as soon as you are confident with your setup.

1. Add your dedicated IT or security email address to the Reporting field to receive your DMARC aggregate reports (rua).

2. Log in to your DNS management console and add a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save the record.

Verify Your Setup

Step 1: Confirm with Moloni

Since Moloni handles custom domains manually, the first step is to receive confirmation from their support team ([email protected]) that your domain has been successfully verified and activated on your account.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your DNS configuration is fully accurate and active across the globe, run an automated check:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly.

What to expect in your domain health results:

DKIM: Pass / Aligned (once fully configured by Moloni support)
DMARC: Policy detected
SPF: Pass

Final Words

Securing your business’s invoicing infrastructure is critical for maintaining healthy cash flow and protecting your clients from fraud. If you want to take your email security further and move securely from p=none to DMARC enforcement without disrupting operations, configure BIMI to display your logo in the inbox, and monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Moloni DKIM, DMARC, and SPF Setup Guide