PandaDoc SPF, DKIM, And DMARC Setup Guide

Key Takeaways

Use a dedicated subdomain. PandaDoc requires you to use a custom subdomain (like docs.yourdomain.com) to manage your document delivery rather than your root domain.
You must contact support. PandaDoc does not provide universal DNS records. You must submit a request through their help widget to get custom records generated for your specific subdomain.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a strict enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to verify your configurations are live and functioning correctly.

If you are using PandaDoc to send proposals, quotes, and contracts to your buyers, setting up custom domain authentication is a critical step.

Configuring proper email authentication (SPF, DKIM, and DMARC) ensures your domain is protected from spoofing and guarantees that your important sales documents safely land in your customers’ inboxes.

Why Authenticate Your Domain for PandaDoc?

PandaDoc is a powerful document automation platform used by sales teams to create, track, and execute contracts.

When you accurately configure the necessary security protocols, you will see immediate benefits:

Stronger Protection: Safeguards your brand from phishing and spoofing, which is crucial for sensitive financial documents.
Increased Deliverability: Ensures strict mailbox providers trust your emails, keeping your proposals out of the junk folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email networks.
Actionable Visibility: Grants transparent insights into who is sending emails on behalf of your business domain.

Steps to Configure PandaDoc SPF and DKIM Records

Before you begin, please note that white-labeling your delivery emails is available only as a paid add-on for users of PandaDoc’s Business Annual plan. Additional setup fees may also apply. Make sure your account meets these requirements before proceeding.

To configure custom domain authentication (which PandaDoc calls white-labeling), you will need access to your PandaDoc workspace and your domain’s DNS management console.

Step 1: Request White-Labeling from PandaDoc Support

Because PandaDoc uses a third-party infrastructure (Mailgun) for custom sending, you cannot generate the records yourself. You must open a support ticket to start the process.

1. Log in to your PandaDoc account.

2. Open the Help widget.

3. Select Product help, then choose Set up white-labeling.

4. Fill in the required details, including the root domain you own and the specific subdomain you want to use (such as docs.yourdomain.com).

5. Submit the ticket.

Alternatively, you can request this directly from your Branding page by clicking the Send request button. Once PandaDoc processes your request, their support team will provide you with a specific set of DNS records.

Step 2: Add the SPF Record to Your DNS

Log in to your DNS provider (like GoDaddy, Route 53, or Cloudflare). Since PandaDoc requires a subdomain, you will publish this SPF record specifically for that subdomain rather than your root domain.

PandaDoc will provide the exact value, but it will typically look like this:

Type: TXT
Host/Name: docs (or docs.yourdomain.com, depending on your DNS host)
Value: v=spf1 include:mailgun.org ~all

Save the record in your DNS console.

Note that the above record is just an example; make sure you add the exact DNS record that PandaDoc support provides.

Step 3: Add the DKIM Record to Your DNS

Next, you will add the DKIM record provided by the PandaDoc support team. This ensures your emails are cryptographically signed and verified by the receiving server.

The exact selector and public key will be unique to your account, but the structure will generally resemble the following:

Type: TXT
Host/Name: smtp._domainkey.docs (or smtp._domainkey.docs.yourdomain.com)
Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3…

Publish this record and save your changes.

Note that the above record is just an example; make sure you add the exact DNS record that PandaDoc support provides.

Step 4: Confirm the Setup

After adding the SPF and DKIM records to your DNS, reply to the PandaDoc support email to confirm the update is complete. The PandaDoc team will verify the DNS records on their end, finalize the configuration, and notify you when your custom domain is ready to use.

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

You can check the record itself with PowerDMARC’s DKIM checker.

For more information, refer to PandaDoc’s official white-labeling guide.

Steps to Enable PandaDoc DMARC Record

You should ensure you have a DMARC record published. Without reporting enabled, you won’t know if your billing emails are failing authentication or if bad actors are spoofing your brand.

Instead of guessing, use PowerDMARC’s free DMARC record generator to create a comprehensive record.

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. For the Policy, select p=none (monitor-only mode). This ensures nothing gets blocked initially, allowing you time to safely review your email traffic before moving to enforcement.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

Important: Jumping straight to enforcement risks blocking your own legitimate business emails. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. However, staying at p=none for too long is not recommended as it leaves your domain vulnerable to phishing and impersonation threats. Move to an enforcement policy as soon as you are confident with your setup.

1. Add your dedicated IT or security email address to the Reporting field to receive your DMARC aggregate reports (rua).

2. Log into your DNS management console and add a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save the record.

Verify Your Setup

Step 1: Send a Test Document

Once PandaDoc support confirms your white-labeling is active, send a test document to an email address you control. Check the received email to ensure it comes from your custom subdomain and that it successfully lands in your inbox.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your DNS configuration is fully accurate and active across the globe, run an automated check:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly.

What to expect in your domain health results:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

Final Words

Securing your document delivery infrastructure is critical for closing deals faster and protecting your buyers from fraud. If you want to take your email security further, move securely from p=none to DMARC enforcement without disrupting operations. Configure BIMI to display your logo in the inbox, and monitor your automated reports seamlessly. The PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

PandaDoc DKIM, DMARC, and SPF Setup Guide