Oracle Email Delivery DKIM, DMARC, And SPF Setup Guide

Key Takeaways

SPF depends on your continent or region. Oracle requires a region-specific or continent-specific include statement in your SPF record to align correctly with their delivery infrastructure.
DKIM records can be generated or imported. Oracle allows you to generate new CNAME-based DKIM keys directly within the OCI console or import your existing keys when migrating platforms.
Merge your SPF carefully. If you already have an existing SPF record, you must add Oracle’s include mechanism to it. Never publish more than one SPF TXT record on your domain.
Begin with a simple DMARC monitoring policy (p=none) to safely analyze incoming mail traffic before transitioning to stricter security rules like quarantine or reject.
Use a third-party DMARC checker tool like PowerDMARC to verify your configurations are live and functioning correctly.

If your organization uses Oracle Cloud Infrastructure (OCI) Email Delivery or Oracle Integration Cloud (OIC) to send transactional messages, notifications, or bulk campaigns, setting up robust domain authentication is a critical step.

Configuring proper email authentication (SPF, DKIM, and DMARC) ensures your domain remains protected from spoofing. Without these records in place, your Oracle-generated emails run a high risk of landing in spam folders or being blocked entirely by major inbox providers like Gmail and Yahoo.

Why Authenticate Your Domain for Oracle Email Delivery?

Oracle Cloud Infrastructure provides enterprise-grade notification and delivery services. While their delivery platform is highly secure, sending mail using an unauthenticated custom domain often triggers spam filters.

When you configure the necessary authentication protocols, you will see immediate benefits:

Stronger Protection: Safeguards your brand from phishing and domain spoofing by verifying that emails originate from a trusted, authorized source.
Increased Deliverability: Major mailbox providers depend on clean authentication signals to decide whether to route notifications directly to the primary inbox.
Actionable Visibility: Grants transparent insights into who is sending emails on behalf of your business domain.

Steps to Configure Oracle SPF and DKIM Records

To begin the setup process, you will need to log in to your Oracle Cloud Infrastructure (OCI) Console and access your domain registrar’s DNS management panel (such as Cloudflare, GoDaddy, or Route 53).

Step 1: Create an Email Domain in OCI

To generate your authentication values, you must first register your sending domain inside the OCI Console.

1. Log in to the OCI Console in the specific region your applications use for mail submission.

2. Open the navigation menu and select Developer Services.

3. Under Application Integration, select Email Delivery, and click Email Domains.

4. Click Create Email Domain, choose your compartment, and enter the exact sending domain or subdomain you will use in your “From” address.
5. Next, open the Approved Senders menu and add each specific email address that will submit mail through Oracle, as OCI rejects mail from unapproved senders.

Step 2: Add the SPF Record to Your DNS

An SPF record tells receiving servers which IP addresses are authorized to send mail for your domain. Oracle uses regional and continental records to keep your configuration optimized.

Log in to your DNS provider’s console and update your TXT records. If you do not have an existing SPF record, create a new TXT record on your root domain (@):

Type: TXT
Host/Name: @
Value:

US/Americas: v=spf1 include:rp.oracleemaildelivery.com ~all
Europe: v=spf1 include:eu.rp.oracleemaildelivery.com ~all
Asia-Pacific: v=spf1 include:ap.rp.oracleemaildelivery.com ~all
All Commercial Regions: v=spf1 include:rp.oracleemaildelivery.com include:ap.rp.oracleemaildelivery.com include:eu.rp.oracleemaildelivery.com ~all

Note: If you have an existing SPF record for other services like Google Workspace or Microsoft 365, do not create a second TXT record. Simply merge the correct Oracle include statement into your existing record before the ~all tag. For example: v=spf1 include:_spf.google.com include:rp.oracleemaildelivery.com ~all.

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Step 3: Add the DKIM Record to Your DNS

DKIM adds a digital signature to your outbound messages, verifying that the email was sent and authorized by the domain owner.

1. Go back to your OCI Console under Email Domains and select your domain name.

2. Under Resources on the left details page, select DKIM and click Add DKIM.

3. Enter your preferred selector name and click Generate DKIM Record.

4. OCI will generate a CNAME record and a CNAME record value.

5. Log in to your DNS provider’s console and publish the generated CNAME record :

Type: CNAME
Host/Name: [selector]._domainkey
Value/Target: [generated_value].dkim.[region].oracleemaildelivery.com

6. Return to the OCI Console, click Add DKIM to complete the generation, and wait for the status to turn active.

You can check the record itself with PowerDMARC’s DKIM checker.

Steps to Enable Oracle DMARC Record

With your SPF and DKIM records published, deploying a DMARC policy is necessary to protect your domain identity.

You can safely construct your DMARC record using PowerDMARC’s free generator:

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. Select your policy as p=none (monitor-only mode). This delivers your messages normally while generating aggregate reports so you can observe the status of your mail flows.

3. Enter your dedicated security email to receive DMARC aggregate reports (rua).

4. Log in to your DNS management panel and add a new TXT record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

5. Save the record.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

Important: Jumping straight to enforcement risks blocking your own legitimate business emails. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. However, staying at p=none for too long is not recommended as it leaves your domain vulnerable to phishing and impersonation threats. Move to an enforcement policy as soon as you are confident with your setup.

Verify Your Setup

Step 1: Verify within Oracle

Go to your Email Domain Details page in the OCI Console. Navigate to the SPF and DKIM verification section and trigger the validation check to ensure Oracle’s platform can successfully read your newly published DNS records.

Step 2: Validate with PowerDMARC

To ensure that your newly published records are correctly aligned and visible to the global mail network, perform an automated domain diagnostic:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly instantly.

In your domain overview, check for:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

Final Words

Securing your business email infrastructure is a key part of maintaining professional client relations and protecting your domain from impersonation. If you want to move safely from p=none to a strict DMARC enforcement policy, implement BIMI to showcase your brand logo in customer inboxes, or monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Oracle Email Delivery DKIM, DMARC, and SPF Setup Guide