MailShogun

Guide

Set up DKIM, SPF and DMARC

Publish the authentication records shown in MailShogun. If the domain stays pending, check the full name, type, value and DNS zone you are editing.

Before you start

Open your domain in the panel and the provider managing its authoritative DNS. Use the values on your domain page: the keys and domains in this guide are examples.

Set up your account and domain

Reviewed on September 11, 2026

What to publish

The domain page shows DKIM, SPF and DMARC records. Copy the type, name and value of every record.

The table shows an example with a custom DKIM key (TXT). If your domain page specifies CNAME, publish the CNAME records it shows; do not convert them to TXT.

Record Type Name Value
DKIM TXT ms1._domainkey v=DKIM1; k=rsa; p=… example
SPF TXT @ v=spf1 include:_spf.mailshogun.com ~all
DMARC TXT _dmarc v=DMARC1; p=none; rua=… example

Copy the complete values from the panel. The ellipses in these examples are not valid record values. If you already had SPF, keep a single record.

DKIM
Lets receivers verify your message signatures. A custom key uses TXT as in this example; some domain pages use CNAME. Publish every record with the type and value shown in your panel, without converting them.
SPF
Authorises MailShogun to send for your domain. If you already have SPF, add only the include; do not delete what you already have.
DMARC
Sets the policy when a message fails DMARC: it needs a valid SPF or DKIM result aligned with the visible From domain. The p=none policy is for monitoring; preserve an existing policy unless you intend to change it.

Where to paste the Name

Check how your provider interprets names. If it appends the domain automatically, use the short host from the panel; if it requires a full name, use that. Check the saved name to avoid duplicating the domain.

Correct Paste only the short host ms1._domainkey
Wrong Do not append the domain again ms1._domainkey.example.com

Wrong becomes ms1._domainkey.example.com.example.com in the zone. MailShogun looks up ms1._domainkey.example.com and stays pending.

If the TXT value is very long

The DKIM TXT sometimes will not fit in one field. The panel warns you.

Most panels split it automatically on save. If yours rejects the paste or truncates the value, split the TXT into quoted chunks of up to 255 characters. DNS joins them when looking up.

Example of a split value
"v=DKIM1; k=rsa; p=(first chunk of the key)" "(rest of the key)"

Do not invent spaces inside the p= key. Only open and close quotes between contiguous chunks.

DNS wait time and “still pending”

Updates depend on the provider, the previous TTL and caches. There is no single guaranteed delay. First check that authoritative nameservers publish the correct value; you do not need to recreate the domain.

  1. Use Check now on the domain page after you have saved what each card asks for.
  2. If it stays pending, re-check Name (short host), the type on each card, and that you are editing the root domain or subdomain zone that matches the panel.
  3. High TTLs or provider cache stretch the wait. Wait a bit and check again before changing the value once more.
  4. When everything matches, each card shows Correct and the domain becomes Verified.

Common failures

If it still fails after the DNS wait, check these before rotating keys.

Looking for a proxy setting on TXT

Cloudflare cannot proxy TXT records: they are always DNS-only. If the panel asks for a DKIM CNAME, keep that CNAME unproxied. You do not need to change your website proxy.

A CNAME where the TXT belongs

If the panel asks for TXT, do not replace it with CNAME; if it asks for CNAME for DKIM, keep that type. A regular CNAME cannot coexist with TXT at the same name. Check the affected service before changing an existing record.

Record in the wrong zone

If the domain in MailShogun is mail.example.com, the records belong in that host’s zone (or as a subdomain under example.com), not only on the root domain. Match the short name and full name from the panel to the zone you edit.

Several SPF records on the same Name

Keep one v=spf1 record per sending domain name. If one exists, merge the MailShogun include while preserving other mechanisms and a single final policy.

Cloudflare and generic panels

The screen differs by provider. The pattern is the same: Type, Name (short host), Value.

Cloudflare documentation: TXT records are always DNS-only

  • Cloudflare: DNS → Records → Add record. Use the type shown in the panel, the required name and the full value. TXT has no proxy option; DKIM CNAMEs must be DNS-only.
  • cPanel, Plesk, Route 53 or your registrar DNS: look for “TXT” or “DNS records”. Use the short name; if the form already shows the domain on the right, do not repeat it on the left.
  • If the field is called Host, Name or Subdomain, paste the same short name the MailShogun panel shows.

Copy, publish, verify

Copy from the panel, publish in your DNS, then Check now.

Domain page

DKIM
TXT ms1._domainkey Copied

SPF and DMARC copy the same way, each on its own card.

Open the panel Getting started Back to index

Check the result

  • Look up the full names shown in the panel and check that the published records match: TXT for a custom key, or CNAME if DKIM asks for it.
  • Run DNS verification. If it fails, note the pending record and compare its full name, type and value before rotating keys.
  • Keep other services’ records and your mailbox MX records. Using MailShogun to send does not require changing where you receive email.

Continue with

Still stuck? Share the error code, time and affected domain with support. Remove passwords, API keys and message contents. Support