Stripe DKIM, DMARC, And SPF Setup Guide

Key Takeaways

Do not use traditional SPF include statements. Adding include:stripe.com or include:spf1.stripe.com to your TXT record is outdated and incorrect. Instead, Stripe authenticates SPF automatically via a delegated subdomain and custom return path CNAME.
Avoid strict DMARC alignment. Stripe does not support strict SPF alignment. Ensure your primary DMARC record uses relaxed alignment (aspf=r) to prevent legitimate transactional emails from failing security checks.
Multiple DNS records are required. To authorize Stripe fully, you must add several CNAME records and a TXT verification record provided inside your Dashboard.
Always start DMARC with monitoring. Begin with a monitoring policy (p=none) to safely analyze incoming mail traffic before transitioning to stricter security rules like quarantine or reject.

When Stripe sends invoices, payment receipts, and customer notifications on your behalf, it defaults to using their own stripe.com sending address. If you want to customize your brand experience and build professional trust, configuring a custom sending domain is the ideal path.

Setting up domain authentication ensures your domain remains protected against impersonation while guaranteeing that critical billing updates do not get trapped in spam filters. This step-by-step guide will walk you through setting up Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) for Stripe.

Why Authenticate Your Domain for Stripe?

Stripe is the leading payment infrastructure provider for businesses worldwide. When you accurately configure domain security protocols for Stripe, your customer communications immediately improve:

Professional Branding: Customer replies route cleanly to your designated business support email rather than a third-party gateway.
Increased Deliverability: Major inbox providers like Google and Yahoo require strict email validation for bulk and transactional sending.
Domain Security: Proper configuration keeps bad actors from spoofing your transactional payment notifications, defending both your business and your clients from financial fraud.

Steps to Configure Stripe SPF and DKIM Records

Before you begin, note that you will need access to your Stripe Dashboard and your domain registrar’s Advanced DNS settings (such as GoDaddy, Cloudflare, Namecheap, or AWS Route 53).

Step 1: Add Your Domain in Stripe

To generate the required DNS records, you must register your sending domain inside your account portal.

Log in to your Stripe Dashboard and navigate to your Customer emails settings page.
Scroll to the Email domain section and click Add domain.
Enter your custom domain name (e.g., yourschool.edu or yourbusiness.com) and click Save.

Stripe will instantly generate a list of custom DNS records specifically mapped to your account. Keep this window open.

Step 2: Configure SPF (Return Path) for Stripe

Because Stripe uses its own mail relays, setting up SPF does not require you to edit your primary domain’s root SPF record. Instead, Stripe manages SPF via a custom subdomain (return path) mapped through a CNAME.

1. Log into your DNS management portal.

2. Locate your DNS record settings and add a new CNAME record based on the details in your Stripe dashboard:

Type: CNAME
Host/Name: bounce (or the specific prefix provided by Stripe, such as bounce.yourdomain.com)
Value/Target: The unique destination domain supplied in your Stripe dashboard.

This delegates your SPF validation for Stripe mail to their secure servers, meaning you do not have to worry about hitting your root domain’s 10 SPF lookup limit.

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Step 3: Configure DKIM for Stripe

DKIM acts as a digital signature to confirm your receipts and invoices have not been tampered with in transit. Stripe provides several CNAME records to authenticate DKIM across their platform.

1. In your DNS portal, create the new CNAME records listed in your Stripe dashboard.

2. These will typically look like this:

First Record Type: CNAME
Host/Name: stripe1._domainkey (or stripe1._domainkey.yourdomain.com)
Value/Target: stripe1._domainkey.stripe.com
Second Record Type: CNAME
Host/Name: stripe2._domainkey
Value/Target: stripe2._domainkey.stripe.com

3. Save all entries.

You can check the record itself with PowerDMARC’s DKIM checker.

For more information, take a look at Stripe’s official support documentation on custom email domains.

Steps to Enable Stripe DMARC Record

With your SPF and DKIM records published, deploying a DMARC policy is necessary to protect your domain identity and satisfy Gmail and Yahoo requirements.

You can safely construct this record using PowerDMARC’s free generator:

1. Go to PowerDMARC’s Free DMARC Record Generator tool.

2. Select your policy as p=none (monitor-only mode). This delivers your messages normally while generating security reports so you can observe the status of your mail flows.

3. Ensure that your Alignment Mode for SPF is set to Relaxed (aspf=r).

Caution: Do not use strict SPF alignment (aspf=s). Because Stripe sends emails from subdomains (like bounce.yourdomain.com), strict alignment will cause legitimate billing emails to fail your DMARC check.

1. Enter your dedicated security email to receive DMARC aggregate reports (rua).

2. Log into your DNS management panel and add a new TXT record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]; aspf=r;

3. Save the record.

If you are confused about what p=none is and what the other policies are, here is a concise explanation:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam/junk folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely, preventing them from being delivered at all.

Important: Jumping straight to enforcement risks blocking your own legitimate business emails. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. However, staying at p=none for too long is not recommended as it leaves your domain vulnerable to phishing and impersonation threats. Move to an enforcement policy as soon as you are confident with your setup.

Verify Your Setup

Step 1: Verify inside Stripe

Navigate back to your Customer emails page in the Stripe Dashboard. Click the Verify domain button next to your configured domain.
Once Stripe confirms ownership and detects the DNS entries, the status will display a green Verified badge. Click on the option menu next to the domain and select Set as sending domain to begin routing customer communications through your custom domain.

(Note: It can sometimes take up to 72 hours for DNS records to update globally. Do not delete these records after verification, as Stripe frequently monitors them to keep your custom domain active.

Step 2: Validate with PowerDMARC

To ensure that your newly published records are correctly aligned and visible to the global mail network, perform an automated domain diagnostic:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly instantly.

In your domain overview, check for:

DKIM: Pass / Aligned
DMARC: Policy detected with aspf=r
SPF: Valid pointing to the designated Stripe subdomain

Final Words

Securing your business’s financial and payment infrastructure is a key part of maintaining professional customer relations. If you want to move safely from p=none to a strict DMARC enforcement policy, implement BIMI to showcase your brand logo in customer inboxes, or monitor your automated reports seamlessly, the PowerDMARC team is here to help.

Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

Stripe DKIM, DMARC, and SPF Setup Guide