WP Engine SPF, DKIM & DMARC Setup Guide

Key Takeaways

WP Engine uses MailChannels. By default, WP Engine routes your native WordPress emails through the MailChannels relay service. You must include this specific relay in your SPF record.
DKIM requires a third-party SMTP. WP Engine does not generate DKIM keys for its default mail service. To achieve full DKIM and DMARC alignment, WP Engine strongly recommends routing your mail through a dedicated third-party SMTP provider (like Mailgun or SendGrid).
Merge your SPF carefully. If you already have an existing SPF record, you must add the MailChannels include mechanism to it. Never create a second SPF TXT record for the same domain.
Begin with a simple DMARC monitoring policy (p=none) to receive aggregate reports and review your traffic before moving to a strict enforcement policy.
Use a third-party DMARC checker tool like PowerDMARC to verify your configurations are live and functioning correctly.

If your website is hosted on WP Engine, ensuring your automated WordPress emails reach your users’ inboxes is critical. Whether it is a password reset link or a contact form notification, properly configuring your domain authentication prevents these messages from disappearing into spam folders.

Setting up proper email authentication (SPF, DKIM, and DMARC) ensures your domain is protected from spoofing. Without these records in place, your WordPress-generated emails run a high risk of being blocked entirely by major inbox providers like Gmail and Yahoo.

Why Authenticate Your Domain for WP Engine?

WP Engine is a premium managed WordPress hosting platform. While they excel at hosting your website securely, the default emails generated by your WordPress site (like user registrations and WooCommerce receipts) are sent from shared IP infrastructure.

When you accurately configure the necessary security protocols, you will see immediate benefits:

Stronger Protection: Safeguards your brand against phishing and spoofing by precisely defining who is authorized to send emails on your behalf.
Increased Deliverability: Ensures strict mailbox providers trust your emails, keeping your site notifications and alerts out of the junk folder.
Boosted Reputation: Enhances your sender score and establishes trust with global email networks.
Actionable Visibility: Grants transparent insights into who is sending emails using your domain identity.

Steps to Configure WP Engine SPF and DKIM Records

WP Engine does not act as your DNS host. To make these changes, you will need to log into your domain registrar’s DNS management panel (such as GoDaddy, Cloudflare, or Namecheap).

Step 1: Add the SPF Record to Your DNS

An SPF record tells other email systems which servers are authorized to send email from your domain. To authorize WP Engine’s default mail infrastructure, you must whitelist MailChannels.

If you do not have an existing SPF record, log into your DNS management panel and create a new TXT record:

Type: TXT
Host/Name: @ (or your root domain)
Value: v=spf1 include:relay.mailchannels.net ~all

(Note: If your DNS already has an SPF record for other services like Google Workspace or Microsoft 365, do not create a second one. Simply add the MailChannels include statement to your existing record right before the ~all tag. For example: v=spf1 include:_spf.google.com include:relay.mailchannels.net ~all)

If you’re managing several sending sources and getting close to the limit, our Hosted SPF solution is worth looking into, and you can check your current record with PowerDMARC’s SPF checker.

Step 2: Handle DKIM Configuration

DKIM adds a digital signature to your emails, proving they genuinely came from your company.

WP Engine officially states that they do not generate public and private DKIM key pairs for emails sent through their default MailChannels relay. To implement DKIM for your WordPress emails, WP Engine highly recommends using a dedicated third-party email host.

You will need to sign up for an SMTP provider like Mailgun, Brevo, or SendGrid, and connect it to your site using an SMTP plugin (like WP Mail SMTP). Once connected, you will generate the DKIM records inside your chosen SMTP provider’s dashboard and publish those unique CNAME or TXT records in your DNS manager.

You can check the record itself with PowerDMARC’s DKIM checker.

Steps to Enable WP Engine DMARC Record

With your SPF and DKIM protocols addressed, you need to publish a DMARC record to maintain visibility over your domain. DMARC helps protect your company’s reputation by defining how other servers should handle messages that fail security checks. Without reporting enabled, you will not know if your emails are failing authentication.

Use PowerDMARC’s free DMARC record generator to create a comprehensive record safely.

Go to PowerDMARC’s Free DMARC Record Generator tool.
For the Policy, select p=none (monitor-only mode). This ensures nothing gets blocked initially, allowing you time to review your email traffic before moving to enforcement.

If you need a quick explanation of the DMARC policies, here is how they work:

p=none (Monitor): Delivers all mail normally but generates reports showing who is sending email on your domain’s behalf.
p=quarantine (Soft Enforcement): Routes unauthorized emails straight to the recipient’s spam folder.
p=reject (Strict Enforcement): Blocks unauthorized emails entirely.

Important: Jumping straight to enforcement risks blocking your own legitimate business emails. Starting with p=none is essential to map out your mail flow and fix any authentication issues safely. However, staying at p=none for too long is not recommended as it leaves your domain vulnerable to phishing and impersonation threats. Move to an enforcement policy as soon as you are confident with your setup.

1. Add your dedicated IT or security email address to the Reporting field to receive your DMARC aggregate reports (rua).

2. Log into your DNS management console and add a new TXT record:

Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected];

3. Save the record.

Verify Your Setup

Step 1: Wait for Propagation

Any changes made within your DNS manager can take 24 to 48 hours to fully update and propagate across the internet.

Step 2: Run a Final Check with PowerDMARC

To guarantee that your DNS configuration is fully accurate and active across the globe, run an automated check:

Use PowerDMARC’s free DMARC Record Checker to verify that your record is published correctly.

What to expect in your domain health results:

DKIM: Pass / Aligned
DMARC: Policy detected
SPF: Pass

Final Words

Securing your business email infrastructure is critical for maintaining professional trust and protecting your clients from fraud. If you want to take your email security further, move securely from p=none to DMARC enforcement without disrupting operations. Configure BIMI to display your logo in the inbox, and monitor your automated reports seamlessly. The PowerDMARC team is here to help.
Get in touch with us or sign up for a demo with PowerDMARC to experience the power of safer email communications firsthand!

About
Latest Posts

Ayan Bhuiya

Shift Lead, Infrastructure & Email Security Expert at PowerDMARC

With over 13 years of experience in Cyber Security, Ayan Bhuiya specializes in Infrastructure, Business Continuity, Risk Management, and Email Security. Currently acting as Shift Lead at PowerDMARC. He holds a Postgraduate Diploma in Networking and Security and has a proven track record of leading strategic security initiatives to mitigate threats and ensure business resilience.

WP Engine DKIM, DMARC, and SPF Setup Guide