Domain authentication

Email authentication are crucial in the world of email marketing as they help ensure the proper deliverability of your campaigns.

Since MailerLite does not provide a service to host your domain, it needs to be hosted outside of MailerLite by a third-party domain hosting provider such as GoDaddy or BlueHost.

For more info on different providers, check out our article on Authenticating with various domain hosts.

In light of Google and Yahoo's new sender requirements for email senders, it is required to authenticate your domain if you are using a custom domain for sending.

To get started:

1. Head to the Account settings page.

2. S select the Domains tab.

3. Click Add domain.

4. Enter the email address you wish to use to send emails from and click Save.

5. Click on Authenticate.

If your DNS provider is one of our partners, you can take advantage of our automatic setup, which simplifies the process even further.

A popup will appear, prompting you to start the authentication process. Click Continue.

This tool will scan your domain, and detect which provider is the host. 

Once the provider has been detected, follow the instructions to connect to your domain.

If your provider is not detected using the above method, we've got you covered with manual domain authentication.

Select your provider from the dropdown menu, or click Other.

2. You’ll get the Name and Value fields for the DKIM and SPF records of this domain. Keep this page open.

4. Access the DNS page of your domain. If you don’t know how, contact your hosting or domain provider for further support (in most cases, their Support team can add the DKIM and SPF records for you).

5. Add the DKIM as a CNAME record and the SPF as a TXT record with their respective Name and Value fields that we provide for you. Please note that these records cannot be modified within MailerLite, so they have to be an exact match.

1. Head back to your MailerLite Domains tab and click on the Authenticate button for the domain you want to authenticate.

2. Click on the green Check DNS Records button to check if the DKIM and SPF records match.

If they match, the records will be approved and the domain will be authenticated.

However, sometimes the site will say that one or both records were not approved, even if all of the information was correctly submitted.

There are 2 reasons why this happens:

• It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes.

• Some information has to be re-checked and updated.

If you encounter any unexpected issues or see that your records haven't been approved right away, don't fret! Give it a little time, and it's likely to sort itself out. Otherwise, we suggest following these troubleshooting steps, or reach out to your hosting provider for help.

Keep in mind, it’s important to ensure you’re adding the records on the platform that actually manages your DNS. This might be your website provider, hosting service, or another service. If the DNS records don’t propagate after 24–48 hours or if your changes aren’t reflected, double-check that you’re adding the records to the correct platform.

Email verification and authentication are important in the world of email marketing as they help ensure the proper deliverability of your campaigns. Aligning your authenticated domain will even boost your deliverability.

A domain can be verified via a confirmation email or by authenticating it.

Since MailerLite does not provide a service to host your domain, it needs to be hosted outside of MailerLite by a third-party domain hosting provider. While this guide will give you general information on authenticating your domain, we have also prepared help articles specific to different domain hosting providers to assist you with the authentication process.

Squarespace
Cloudflare
GoDaddy
SiteGround
Google Domains
Wix
IONOS by 1&1
Bluehost

You can also follow our helpful video tutorial on Email domain authentication.

Although optional, we highly suggest that you authenticate your own custom domain to improve your deliverability rates. 

It also significantly increases the chances of your email landing in the recipients’ inboxes rather than the spam or junk folder.

To authenticate it, you will need to add two TXT records to the DNS page of your domain: 

• DKIM (DomainKeys Identified Mail): a sender identification tool that is used by email clients (such as Google, Yahoo, and Outlook) to identify and protect from phishing, spoofing and forgery.

• SPF (Sender Policy Framework): indicates which IP addresses and/or hostnames have been authorized to send emails from the specific domain.

1. Head to Domains.

2. Click Add domain.

3. Enter the email address you wish to use to send emails from and click Send verification email.

4. Once you receive the confirmation email, click on the Confirm my email address link.

5. You will see a success message confirming the domain verification.

1. Head to Domains.

2. Click on Authenticate for verified domains, or Add domain for unverified ones (and then click on Send confirmation email). 

3. You’ll get the Name and Value fields for the DKIM and SPF records. Keep this page open.

4. Access the DNS page of your domain. If you don’t know how, contact your hosting provider for further support (in most cases, the Support team of your hosting provider can add the DKIM and SPF records for you).

5. Add both the DKIM and SPF as TXT records with their respective Name and Value fields that we provide for you. Please note that these records cannot be modified within MailerLite, so they have to be an exact match.

Head back to your MailerLite Domains page and click on the green Check DNS records button located below the records.

You will be notified once both records have been approved.

However, sometimes the site will say that one or both records were not approved, even if all of the information was correctly submitted.

There are two reasons why this happens:

• It can take the servers up to 24 hours to completely update this information. Most of the time, however, it is approved and updated in a matter of minutes.

• Some information has to be re-checked and updated.

Even if you are sure you set up the information correctly, we suggest that you follow the troubleshooting steps below, just in case.

DKIM record is not approved

If the DKIM record fails:

• Depending on your DNS zone, the Host field will accept either ml._domainkey (without your domain) or ml._domainkey (plus your domain), so try both.

• Check that both Value fields are exactly the same, as they’re case-sensitive.

If you’re unsure they are an exact match, you can check both texts here.

If you’ve already checked the above and both fields are exactly as they are shown in MailerLite, it may be that your domain system may not parse the DKIM value correctly. 

If this is the case, you could use an external tool such as DKIM Core to check for any errors. If you see that only the k=rsa part is being recognized and nothing else, then this means that the DKIM value is not parsing correctly on your DNS.

To rectify this, you should ‘escape’ the semicolon (;) symbol by adding a backslash (\) symbol before it.

To do this, simply change the initial value from k=rsa; p= to k=rsa\; p=.

SPF record is not approved

There are three reasons why an SPF record may not be approved:

• SPF records don’t match

• SPF Name record field must be left empty

• More than one SPF record was found

SPF records don't match

• Check the Host Name. 

• Check if the Value field on your DNS page is exactly the same as the one on your MailerLite Domains page. They have to be identical as they are case-sensitive. The record won’t be approved otherwise. 

You can use this site to compare both texts.

SPF Name record field must be left empty

Some hosting providers have settings that don’t allow the domain as the Name field for any record. 

Use ‘@’ as the Name field for the TXT record or leave it empty. 

If you see that there is a common Name field being used for the rest of the records in the DNS page of your domain, try using that one.

More than one SPF record was found

It’s only possible to have one SPF record on your DNS zone. If you have more than one, they need to be merged.

In the image below, you will see two different TXT records for SPF. Both of these need to be merged into one single record.

Fortunately, MailerLite does this for you after you click once on the green Check DNS records button. This allows the site to check and update the SPF record’s Value with the merged version after clicking on it. The updated SPF value will be available on the same pop-up page.

At first, you will notice that the SPF value record will look something like this:

v=spf1 a mx include:_spf.mlsend.com ?all

After clicking on the green Check DNS records button and receiving the error message that more than one SPF record has been found, refresh the page, click on the Check status button, and most likely, you will see that there is a new merged value for the SPF record. 

You can confirm this by examining it. The merge was successful if the text includes more than one include.

An example of a merged SPF record from MailerLite and Outlook:

v=spf1 a mx include:_spf.mlsend.com include:spf.protection.outlook.com -all

Before setting up the new merged SPF record, it’s important to:

• Remove all of the current SPF records in your DNS zone, including the original one from MailerLite that is not merged.

• Add a new TXT record with the merged SPF record.

• Go back to your MailerLite Domains page and click on the green Check DNS records button.

An error may still come up even after setting up the merged SPF record in the DNS zone. Don’t worry if this happens. Remember that servers can take up to 24 hours to completely update this information. Most of the time, however, it’s approved within a few minutes to a few hours.

You can check if the SPF record is correctly set up with this third-party tool.

If you are seeing that your emails are being sent with a notice that says “Via mlsend” on the sender’s email address, this is sometimes added in Gmail or in other email providers to indicate that the email is sent through Mailerlite’s servers. It doesn’t do any harm, as the emails are in fact being sent via the mlsend domain. Gmail and other email providers will stop displaying this once they start “trusting” the sender, which can be helped by authenticating the sending domain and building a healthy domain reputation.

Mlsend, mlsend2 and mlflow are domains owned by MailerLite and are used for sending emails. Similar to how Google's UTM tags work, the "ml" domains are used to gather click statistics to support our customers' email marketing efforts.

If you have any questions, contact our friendly support team and we will gladly assist you.

Please note: While we’re happy to help with any issues taking place on our end, we do not have access your accounts with other apps or tools, even if they are connected to your Mailerlite account. This limits the support we can offer, so we encourage reaching out directly to the support team of those third-party tools for better assistance.

In this case, you can reach out to your domain host for help with adding new records to your DNS panel.