How to verify, authenticate and align your domain

Email verification and authentication are important in the world of email marketing as they help ensure the proper deliverability of your campaigns. Aligning your authenticated domain can also boost your deliverability.

A domain can be verified via a confirmation email or by authenticating it.

Since MailerLite does not provide a service to host your domain, it needs to be hosted outside of MailerLite by a third-party domain hosting provider. While this guide will provide general information for authenticating your domain, we have created the following help articles to assist with authenticating your domain in various domain hosts:

Squarespace
Cloudflare
GoDaddy
Wix
IONOS by 1&1
Bluehost

You can also follow our helpful video tutorial on Email domain authentication.

Google and Yahoo have announced new rules for bulk email senders effective February 2024, which affects senders using MailerLite. With these new rules, you will not be able to use a free email domain (such as Gmail) as your sender address. Instead, it is required to use an email address that is connected to an authenticated domain that you own.

Domain authentication is also required for those that have domains with Quarantine or Reject DMARC policies.

What does this mean? DMARC is an email authentication protocol that is set up on the DNS settings of a domain as a TXT record. There are three policy settings in DMARC: None, Quarantine, and Reject. You can read more about each of these terms in The basics of DMARC.

Your DMARC settings can be found in your domain host. If your DMARC policy is set to Quarantine or Reject, you will see a message in your account notifying you to authenticate your sending domain before sending campaigns from that domain in MailerLite.

1. Head to the Account settings page select the Domains tab.

2. Click Add domain.

3. Enter the email address you wish to use to send emails from and click Save.

4. Once you receive the confirmation email, click on the Confirm my email address link.

5. You will see a success message confirming the domain verification.

To authenticate your domain, you will need to add two records to the DNS panel of your domain: 

• DKIM (DomainKeys Identified Mail): a sender identification tool that is used by email clients (such as Google, Yahoo, and Outlook) to identify and protect from phishing, spoofing and forgery.

• SPF (Sender Policy Framework): indicates which IP addresses and/or hostnames have been authorized to send emails from the specific domain.

To get started:

1. Head to the Settings page select the Domains tab.

2. Click on Authenticate for a verified domain, or Add domain for an unverified one (and then click on Send confirmation email). 

3. You’ll get the Name and Value fields for the DKIM and SPF records of this domain. Keep this page open.

4. Access the DNS page of your domain. If you don’t know how, contact your hosting or domain provider for further support (in most cases, their Support team can add the DKIM and SPF records for you).

5. Add the DKIM as a CNAME record and the SPF as a TXT record with their respective Name and Value fields that we provide for you. Please note that these records cannot be modified within MailerLite, so they have to be an exact match.

1. Head back to your MailerLite Domains tab and click on the Authenticate button for the domain you want to authenticate.

2. Click on the green Check DNS Records button to check if the DKIM and SPF records match.

If they match, the records will be approved and the domain will be authenticated.

However, sometimes the site will say that one or both records were not approved, even if all of the information was correctly submitted.

There are 2 reasons why this happens:

• It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes.

• Some information has to be re-checked and updated.

Even if you are sure you set up the information correctly, we suggest that you follow the troubleshooting steps below, just in case.

DKIM record is not approved

If the DKIM record fails:

• Check the Host field value: Depending on your DNS zone, the Host field may only accept either litesrv._domainkey (without your domain) or litesrv._domainkey.yourdomain.com, so try both.

• Check the record type: The DKIM record should be CNAME type.

SPF record is not approved

There are 3 reasons why an SPF record may not be approved:

1. SPF records don’t match

• Check the Host field. 

• Check if the Value field on your DNS page is exactly the same as the one on your MailerLite Domains page. They have to be identical as they are case-sensitive. The record won’t be approved otherwise. 

You can use this site to compare both texts.

2. SPF Name/Host record field must be left empty

Some hosting providers have settings that don’t allow the domain as the Name or Host field for any record. 

Use ‘@’ as the Name or Host field for the TXT record or leave it empty. 

If you see that there is a common Name or Host field being used for the rest of the records in the DNS page of your domain, try using that one.

3. More than one SPF record was found

It’s only possible to have one SPF record on your DNS zone. If you have more than one, they need to be merged.

In the image below, there are two different TXT records for SPF. Both of these need to be merged into one single record.

Fortunately, MailerLite does this for you after you click once on the green Check DNS records button. This allows the site to check and update the SPF record’s Value with the merged version after clicking on it. The updated SPF value will be available on the same pop-up page.

At first, you will notice that the SPF value record will look something like this:

v=spf1 a mx include:_spf.mlsend.com ?all

After clicking on the green Check DNS records button and receiving the error message that more than 1 SPF record has been found, refresh the page, click on the Authenticate button, will likely see that there is a new merged value for the SPF record. 

You can confirm this by examining it. The merge was successful if the text includes more than one include.

An example of a merged SPF record from MailerLite and Outlook:

v=spf1 a mx include:_spf.mlsend.com include:spf.protection.outlook.com -all

Before setting up the new merged SPF record, it’s important to:

• Remove all of the current SPF records in your DNS zone, including the original one from MailerLite that is not merged.

• Add a new TXT record with the merged SPF record.

• Go back to your MailerLite Domains page and click on the green Check DNS records button.

An error may still come up even after setting up the merged SPF record in the DNS zone. Don’t worry if this happens. Remember that servers can take up to 24 hours to completely update this information. Most of the time, however, it’s approved within a few minutes to a few hours.

You can check if the SPF record is correctly set up with this third-party tool.

If you are seeing that your emails are being sent with a notice that says “Via mlsend” on the sender’s email address, this is sometimes added in Gmail or in other email providers to indicate that the email is sent through Mailerlite’s servers. It doesn’t do any harm, as the emails are in fact being sent via the mlsend domain. Gmail and other email providers will stop displaying this once they start “trusting” the sender, which can be helped by authenticating the sending domain and building a healthy domain reputation.

Mlsend, mlsend2 and mlflow are domains owned by MailerLite and are used for sending emails. Similar to how Google's UTM tags work, the "ml" domains are used to gather click statistics to support our customers' email marketing efforts.

For example, if you are including a link in your campaign, subscribers will be directed to the intended domain via an mlsend domain in order to properly record data for your reports. If you would prefer the links to redirect using your own domain rather than the default mlsend one, you can do so by setting up domain alignment.

Domain alignment is an additional authentication method that lets you use your own domain throughout the entire email message, including the email header, tracking links, and image hyperlinks. It is an advanced yet optional feature to further boost deliverability. 

The benefits of aligning your domains include:

• Your sending domain will appear more trustworthy and credible to spam filters.

• All links will be redirected using your own domain instead of a MailerLite domain.

• Your “From” address will display as your own domain, and not as “via mlsend”.

• You will have better control over your personal sending reputation via your sending domain and links inside the emails.

• You will have safer DMARC implementation with two independent alignment mechanisms.

To align a domain for sending, your domain should be authenticated beforehand.

1. Head to Settings and select the Domains tab.

2. On the Sending domains section, under the Domain alignment column, click on Add custom domain for the sending domain you wish to align.

3. Under Subdomain prefix, enter a prefix to create a new subdomain and click Add.

4. You will now see three records: A, MX, and TXT records. Create the A, MX and TXT records on your DNS zone page and copy and paste the value of each record, respectively.

5. Save these changes and then click Check DNS records in MailerLite.

Once the records have propagated and been accepted on your DNS zone, which in some cases may take up to 24 hours, you will see an ON/OFFswitch under Domain alignment.

All you have to do now is toggle the ON button to have your domain aligned.

If you have any questions, contact our friendly support team and we will gladly assist you.

Please note: While we’re happy to help with any issues taking place on our end, we do not have access your accounts with other apps or tools, even if they are connected to your MailerLite account. This limits the support we can offer, so we encourage reaching out directly to the support team of those third-party tools for better assistance.

In this case, you can reach out to your domain host for help with adding new records to your DNS panel.

Email verification and authentication are important in the world of email marketing as they help ensure the proper deliverability of your campaigns. Aligning your authenticated domain will even boost your deliverability.

A domain can be verified via a confirmation email or by authenticating it.

Click here if you’re authenticating your domain with GoDaddy, or here if you’re authenticating your domain with Wix.

You can also watch a video tutorial here.

Although optional, we highly suggest that you authenticate your own custom domain to improve your deliverability rates. 

It also significantly increases the chances of your email landing in the recipients’ inboxes rather than the spam or junk folder.

To authenticate it, you will need to add two TXT records to the DNS page of your domain: 

• DKIM (DomainKeys Identified Mail): a sender identification tool that is used by email clients (such as Google, Yahoo, and Outlook) to identify and protect from phishing, spoofing and forgery.

• SPF (Sender Policy Framework): indicates which IP addresses and/or hostnames have been authorized to send emails from the specific domain.

1. Head to Domains.

1. Click Add domain.

2. Enter the email address you wish to use to send emails from and click Send verification email.

1. Once you receive the confirmation email, click on the Confirm my email address link.

2. You will see a success message confirming the domain verification.

1. Head to Domains.

2. Click on Authenticate for verified domains, or Add domain for unverified ones (and then click on Send confirmation email). 

3. You’ll get the Name and Value fields for the DKIM and SPF records. Keep this page open.

1. Access the DNS page of your domain. If you don’t know how, contact your hosting provider for further support (in most cases, the Support team of your hosting provider can add the DKIM and SPF records for you).

2. Add both the DKIM and SPF as TXT records with their respective Name and Value fields that we provide for you. Please note that these records cannot be modified within MailerLite, so they have to be an exact match.

Head back to your MailerLite Domains page and click on the green Check DNS records button located below the records.

You will be notified once both records have been approved.

However, sometimes the site will say that one or both records were not approved, even if all of the information was correctly submitted.

There are two reasons why this happens:

• It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes.

• Some information has to be re-checked and updated.

Even if you are sure you set up the information correctly, we suggest that you follow the troubleshooting steps below, just in case.

DKIM record is not approved

If the DKIM record fails:

• Depending on your DNS zone, the Host field will accept either ml._domainkey (without your domain) or ml._domainkey (plus your domain), so try both.

• Check that both Value fields are exactly the same, as they’re case-sensitive.

If you’re unsure they are an exact match, you can check both texts here.

If you’ve already checked the above and both fields are exactly as they are shown in MailerLite, it may be that your domain system may not parse the DKIM value correctly. 

If this is the case, you could use an external tool such as DKIM Core to check for any errors. If you see that only the k=rsa part is being recognized and nothing else, then this means that the DKIM value is not parsing correctly on your DNS.

To rectify this, you should ‘escape’ the semicolon (;) symbol by adding a backslash (\) symbol before it.

To do this, simply change the initial value from k=rsa; p= to k=rsa\; p=.

SPF record is not approved

There are three reasons why an SPF record may not be approved:

• SPF records don’t match

• SPF Name record field must be left empty

• More than one SPF record was found

SPF records don't match

• Check the Host Name. 

• Check if the Value field on your DNS page is exactly the same as the one on your MailerLite Domains page. They have to be identical as they are case-sensitive. The record won’t be approved otherwise. 

You can use this site to compare both texts.

SPF Name record field must be left empty

Some hosting providers have settings that don’t allow the domain as the Name field for any record. 

Use ‘@’ as the Name field for the TXT record or leave it empty. 

If you see that there is a common Name field being used for the rest of the records in the DNS page of your domain, try using that one.

More than one SPF record was found

It’s only possible to have one SPF record on your DNS zone. If you have more than one, they need to be merged.

In the image below, you will see two different TXT records for SPF. Both of these need to be merged into one single record.

Fortunately, MailerLite does this for you after you click once on the green Check DNS records button. This allows the site to check and update the SPF record’s Value with the merged version after clicking on it. The updated SPF value will be available on the same pop-up page.

At first, you will notice that the SPF value record will look something like this:

v=spf1 a mx include:_spf.mlsend.com ?all

After clicking on the green Check DNS records button and receiving the error message that more than one SPF record has been found, refresh the page, click on the Check status button, and most likely, you will see that there is a new merged value for the SPF record. 

You can confirm this by examining it. The merge was successful if the text includes more than one include.

An example of a merged SPF record from MailerLite and Outlook:

v=spf1 a mx include:_spf.mlsend.com include:spf.protection.outlook.com -all

Before setting up the new merged SPF record, it’s important to:

• Remove all of the current SPF records in your DNS zone, including the original one from MailerLite that is not merged.

• Add a new TXT record with the merged SPF record.

• Go back to your MailerLite Domains page and click on the green Check DNS records button.

An error may still come up even after setting up the merged SPF record in the DNS zone. Don’t worry if this happens. Remember that servers can take up to 24 hours to completely update this information. Most of the time, however, it’s approved within a few minutes to a few hours.

You can check if the SPF record is correctly set up with this third-party tool.

If you are seeing that your emails are being sent with a notice that says “Via mlsend” on the sender’s email address, this is sometimes added in Gmail or in other email providers to indicate that the email is sent through Mailerlite’s servers. It doesn’t do any harm, as the emails are in fact being sent via the mlsend domain. Gmail and other email providers will stop displaying this once they start “trusting” the sender, which can be helped by authenticating the sending domain and building a healthy domain reputation.

Mlsend, mlsend2 and mlflow are domains owned by MailerLite and are used for sending emails. Similar to how Google's UTM tags work, the "ml" domains are used to gather click statistics to support our customers' email marketing efforts.

For example, if you are including a link in your campaign, subscribers will be directed to the intended domain via an mlsend domain in order to properly record data for your reports. If you would prefer the links to redirect using your own domain rather than the default mlsend one, you can do so by setting up domain alignment.

Domain alignment is an additional authentication method that lets you use your own domain throughout the entire email message, including the email header, tracking links, and image hyperlinks. It is an advanced yet optional feature to further boost deliverability. 

The benefits of aligning your domains include:

• Your sending domain will appear more trustworthy and credible to spam filters.

• All links will be redirected using your own domain instead of a MailerLite domain.

• Your “From” address will display as your own domain, and not as “via mlsend”.

• You will have better control over your personal sending reputation via your sending domain and links inside the emails.

• You will have safer DMARC implementation with two independent alignment mechanisms.

To align a domain for sending, your domain should be authenticated beforehand.

1. Navigate to Domains through the main dropdown menu.

1. Find the authenticated domain you wish to align and click Add custom domain.

1. Under Subdomain prefix, enter a prefix to create a new subdomain and click Add.

1. You will now see three records: A, MX, and TXT records. Create the A, MX and TXT records on your DNS zone page and copy and paste the value of each record, respectively.

1. Save these changes and then click Check DNS records in MailerLite.

Once the records have propagated and been accepted on your DNS zone, which in some cases may take up to 24 hours, you will see an ON/OFF switch under Domain alignment.

All you have to do now is toggle the ON button to have your domain aligned.

If you have any questions, contact our friendly support team and we will gladly assist you.

Please note: While we’re happy to help with any issues taking place on our end, we do not have access your accounts with other apps or tools, even if they are connected to your Mailerlite account. This limits the support we can offer, so we encourage reaching out directly to the support team of those third-party tools for better assistance.

In this case, you can reach out to your domain host for help with adding new records to your DNS panel.