QQ Mail & Tencent Enterprise Mail Authentication Guide: SPF, DKIM, And DMARC

Key Takeaways

Properly configuring SPF, DKIM, and DMARC is critical to proving to receiving mail servers that QQ Mail and Tencent Enterprise Mail are authorized to send messages on your behalf.
You must never publish more than one SPF TXT record on your domain. If you already have one, simply append Tencent’s include statement (include:spf.mail.qq.com).
Generating and publishing a DKIM key from your Tencent admin console adds a layer of cryptographic trust to your outbound emails, ensuring they haven’t been tampered with in transit.
Begin your DMARC journey with a p=none policy to safely observe your mail flow and catch setup errors before enforcing stricter rules.

When your organization uses QQ Mail or Tencent Enterprise Mail to send business communications, your emails are addressed from your corporate domain (e.g., yourdomain.com) but are physically dispatched from Tencent’s mail servers.

Without proper DNS authorization, inbox providers may flag this discrepancy as a spoofing risk. By implementing SPF, DKIM, and DMARC, you bridge this trust gap, drastically lowering bounce rates, preventing domain spoofing, and ensuring your messages reach the inbox.

Why Authenticate Your Domain for QQ Mail?

Leaving your outbound emails unauthenticated carries significant operational risks. Configuring these protocols yields immediate benefits:

Bypasses Spam Filters: Major mailbox providers heavily scrutinize bulk and enterprise senders. Alignment of SPF and DKIM ensures your campaigns and transactional emails bypass automated spam traps.
Builds Sender Trust: A correctly configured authentication policy helps receiving mail systems distinguish your authorized emails from unauthorized servers attempting to exploit your domain.
Secures Your Brand: Defends your domain name against phishing and spoofing attacks.

Steps to Configure QQ Mail SPF

SPF tells receiving servers which IP addresses and domains are permitted to send mail for your domain.

Scenario A: If you DO NOT have an existing SPF record

If your domain does not yet have an SPF record, you need to add a new TXT record in your DNS hosting provider’s console (e.g., Cloudflare, GoDaddy, or your enterprise DNS administrator).

Type: TXT
Host/Name: @ (or leave blank, applying to the root domain)
Value:

None v=spf1 include:spf.mail.qq.com ~all

Scenario B: If you DO have an existing SPF record (Most Common)

If your domain already has an SPF record (such as one for a CRM, marketing platform, or help desk), do not create a second SPF record. Creating multiple SPF records will cause validation errors and break your email authentication.

Instead, edit your existing TXT record and insert include:spf.mail.qq.com right before the final mechanism (such as ~all or -all).

Before:

None v=spf1 include:example-mailer.com ~all

After:

None v=spf1 include:spf.mail.qq.com include:example-mailer.com ~all

Pro Tip: Every time you add an include statement, it counts against the strict 10-lookup limit for SPF. If combining includes risks exceeding this limit, use PowerDMARC’s Hosted SPF / SPF Flattening to keep your record compact and error-free. You can review your current lookups using PowerDMARC’s SPF checker.

Steps to Configure DKIM for QQ Mail

While SPF authorizes the server, DKIM provides a cryptographic signature that proves the email hasn’t been altered during transit. Under the hood, your outgoing messages are encrypted using your domain’s unique private key to generate a DKIM signature, which is inserted into your email header. The recipient’s mail server then fetches your public key via DNS to verify the signature’s validity and guarantee the integrity of your email content.

Step 1: Generate the Keys in the Tencent Admin Portal

Log in to your Tencent Enterprise Mail Administrator Backend.
Navigate directly to the Toolbox section.
Select DKIM Verification from the available tools.
The system will automatically display the generated Host Record name (your selector) and the TXT Value (the cryptographic public key string).
Copy these two configuration values.

Step 2: Publish the DKIM Record in Your DNS

Type: TXT
Host Record / Name: [selector]._domainkey (e.g., if the selector is s1, enter s1._domainkey)
TXT Value: (Paste the entire public key string provided, which will start with v=DKIM1; k=rsa; p=…)

Step 3: Validate and Enable

Return to the Tencent Enterprise Mail Admin Backend > Toolbox > DKIM Verification section.
Click Verify Now (or the verification button) to prompt Tencent to check your DNS settings.
Once the verification succeeds, Tencent will automatically begin signing all outbound mail sent from your domain. You can independently verify that your key is active and formatted correctly using PowerDMARC’s DKIM checker.

Steps to Configure Your DMARC Record

With SPF and DKIM in place, you are ready to configure DMARC. This protocol acts as the instruction manual for receiving servers on what to do if an email fails SPF or DKIM checks. Build a fully compliant record safely with PowerDMARC’s free DMARC Record Generator.

Open the Free DMARC Record Generator tool.
Choose p=none (monitor-only mode) for your policy. This is a safe starting point that prevents mail from being blocked while you analyze your traffic for errors.

Here is a quick breakdown of the available policies:

p=none (Monitor): Allows normal mail delivery while generating valuable reports on your domain’s sending activity.
p=quarantine (Soft Enforcement): Sends emails that fail authentication directly to the recipient’s spam folder.
p=reject (Strict Enforcement): Outright rejects failing emails so they never reach the recipient.

Important: Do not jump straight to an enforcement policy (quarantine or reject). Doing so could block legitimate communications. A monitoring policy helps you fix underlying issues safely.

1. Enter a dedicated email address in the Reporting field so you can receive your aggregate (rua) reports.

2. Access your DNS settings and create a new record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save your new TXT record.

Verify Your Setup

To be absolutely certain your QQ Mail infrastructure is authenticated, validate your published records using PowerDMARC’s free DMARC Record Checker.

A successful check will display:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

If your overall score is a bit low, it usually means you still need to implement advanced protections like BIMI or MTA-STS.

Final Words

Ready to maximize your email security? The PowerDMARC team can help you confidently transition to DMARC enforcement, avoid SPF lookup limits with automatic flattening, and display your brand logo in customer inboxes with BIMI.
Reach out to our team or book a PowerDMARC demo today to secure your business communications!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

QQ Mail & Tencent Enterprise Mail Authentication Guide: SPF, DKIM, and DMARC