SPF record for Fastmail

Fastmail sends mail for your users on your own domain. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Add this include to the SPF record on your sending domain:

A complete record for a domain that also sends through Google Workspace:

Fastmail prints the whole record on its manual DNS page as v=spf1 include:spf.messagingengine.com ?all, and when I checked on 4 Sep 2026 that was still the published value. Take the include from it. Decide the ending separately.

?all is the neutral qualifier. With it, receivers pass Fastmail's servers and give every other server a neutral result, so a forged message from any other address gets a neutral result too. If Fastmail sends all the mail for the domain, publish -all.

Then count your lookups, because SPF allows ten DNS lookups across the whole chain of includes. At the eleventh, receivers return a permerror and SPF fails for every sender in the record, even though the record looks right when you read it. Run the domain through the SPF checker after every change. The count also moves when a provider changes its own records.

DKIM

Fastmail's page says to add all three of these CNAMEs:

Your domain appears twice in every target, once as the host and once in front of dkim.fmhosted.com. Fastmail holds the keys and rotates between all three, so you need every one of them.

Domains hosted at Fastmail before 2018 also carry mesmtp._domainkey, which Fastmail's page marks deprecated. Leave it where it is unless Fastmail tells you to remove it.

DMARC alignment with Fastmail

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Mail your users send carries your domain in the envelope sender and in the signature, so SPF and DKIM both align without any extra work.
• An app or a device sending through Fastmail's SMTP with an app password is covered by the same records. One sending through your web host is not, and its addresses have to go in the record separately.
• A neutral ?all ending gives no SPF pass to servers outside the record. Mail from Fastmail still passes through the include. Any other server sending as your domain needs aligned DKIM to pass DMARC.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Fastmail to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Fastmail's own documentation, at Fastmail help center. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.