SPF record for Stripe

Stripe sends invoices, receipts and failed payment notices to your customers. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Stripe publishes no include for your root record. Its custom email domain page, which I checked on 4 Sep 2026, lists the records, and the Dashboard generates all of them. You get a TXT record that shows you own the domain, a CNAME for the Mail From domain, and CNAMEs for the DKIM keys.

That page also says Stripe doesn't support strict SPF alignment, so your DMARC record must not carry aspf=s. Relaxed alignment is the default, and leaving aspf out of the record altogether is the same thing.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS lookups across the whole chain of includes. Go over and receivers return a permerror, and SPF fails for every sender in the record. Our free SPF checker follows every include and gives you the count.

DKIM

The DKIM records are CNAMEs under names Stripe generates for your account, so there is no selector to print here. Publish them exactly as the Dashboard gives them, and watch the Name field: Stripe's troubleshooting says some DNS providers append your domain themselves, which is how a record ends up carrying it twice.

A CNAME has to be the only record at its name. A leftover TXT at the same host from an earlier attempt stops the CNAME resolving, and Stripe reports the record as missing while the panel shows it sitting there.

Return path and SPF alignment

The Mail From CNAME is what makes SPF align. It puts a subdomain of yours in the envelope sender, so the SPF pass lands on your domain instead of Stripe's and aligns with your From address under relaxed matching. Copy it from Customer emails in the Dashboard along with the other records.

DMARC alignment with Stripe

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Stripe wants a DMARC record on the domain before it will send customer email from it, and suggests starting at p=none for monitoring.
• The mailbox names are a fixed list: billing, invoice, receipts, support and a few more. You choose the domain, not the part in front of the at sign.
• Replies go to the support address in your public business information rather than to the address the message came from. DMARC is unaffected, because receivers check the From domain.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Stripe to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Stripe's own documentation, at Stripe documentation. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.