Setup Guide

How to Set Up SPF, DKIM, and DMARC for Omnisend

Omnisend is an email and SMS marketing platform built for e-commerce stores, particularly those running on Shopify, WooCommerce, and BigCommerce. It sends promotional campaigns, automation flows (abandoned cart, welcome series, post-purchase), and transactional messages. Omnisend routes all outbound email through Mailgun's infrastructure.

SPF Configuration

Omnisend uses Mailgun for sending, so the SPF include is Mailgun's:

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:mailgun.org ~all

Combined with other services:

v=spf1 include:_spf.google.com include:mailgun.org ~all

Important: include:mailgun.org consumes approximately 4 DNS lookups due to nested sub-includes (_spf.mailgun.org, _spf.eu.mailgun.org, and their children). If you're also using Google Workspace and other services, audit your total lookup count carefully.

Note on SPF alignment: Adding include:mailgun.org authorizes Omnisend's sending IPs, but the envelope-from (return-path) will be on a Mailgun-owned domain — not your domain. SPF will pass, but it will not align with your From domain under DMARC. DKIM alignment is your path to DMARC compliance with Omnisend.

Verify your total lookup count with the SenderClarity SPF Checker.

DKIM Configuration

Omnisend offers custom domain DKIM signing for free on all plans.

  1. In Omnisend, go to Store Settings → Domains.
  2. Click + Add domain and enter your sending domain.
  3. Omnisend will provide a DKIM TXT record:
Type:  TXT
Host:  pic._domainkey
Value: k=rsa; p=(provided by Omnisend — unique to your account)
  1. Add the TXT record to your DNS.
  2. Return to Omnisend and verify. Propagation typically takes 30 minutes but can take up to 48 hours.

The selector pic is Omnisend's standard DKIM selector. The full DNS lookup will be pic._domainkey.yourdomain.com.

DNS provider note: When adding the record, look for tutorials covering TXT record format specifically. Omnisend's DKIM uses a TXT record, not a CNAME.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Progress to enforcement:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

DMARC Considerations for Omnisend

  • SPF alignment is not achievable with Omnisend: Omnisend does not support a custom return-path domain. The envelope-from is always a Mailgun-managed subdomain, not your domain. SPF will appear as misaligned in your DMARC reports regardless of whether you add include:mailgun.org to your SPF record. DKIM is the only path to DMARC compliance.

  • DMARC aggregate reports will show Mailgun IPs, not Omnisend IPs: Because Omnisend sends through Mailgun's infrastructure, the source IPs in your reports will belong to Mailgun's IP ranges (US and EU pools). The reporting source will not identify itself as Omnisend — cross-reference against Mailgun IP ranges if you see unfamiliar sources.

  • E-commerce stacks create multiple senders at once: Omnisend is rarely the only service sending as your domain in a typical e-commerce setup. Shopify transactional emails, payment processor receipts, review request apps (Judge.me, Yotpo), and loyalty platform emails all use your domain. Do not move to enforcement until every source in your DMARC reports is accounted for.

  • Omnisend provides a DMARC record suggestion during setup: The domain setup wizard pre-fills a p=none DMARC record. Use this as a starting point but replace the RUA address with your SenderClarity reporting address to receive consolidated reports across all your sending sources.

  • Domain DKIM is free on all plans: Unlike some ESPs that gate custom authentication behind paid tiers, Omnisend offers domain signature setup at no extra cost to all users, including free plan accounts.

Verification

  • Check your SPF record →
  • Send a test campaign from Omnisend
  • Check email headers for dkim=pass aligned to your domain
  • Monitor DMARC reports in SenderClarity for Omnisend traffic

Common Issues

DMARC shows SPF failing alignment: This is expected with Omnisend — the return-path is always on a Mailgun domain. As long as DKIM is passing and aligned, your DMARC result is pass. Do not attempt to fix the SPF alignment; focus on ensuring DKIM is properly configured.

Approaching the SPF lookup limit: include:mailgun.org alone consumes ~4 lookups. If you're using Google Workspace (3–4 lookups) and Omnisend, you're already at 7–8. Any additional services risk pushing you over the 10-lookup limit. Check your total with the SPF Checker.

Omnisend emails showing "via mailgun.us" or similar: This label appears in some email clients when DKIM is not yet authenticated for your domain. Completing the domain setup in Omnisend removes it.

SPF Lookup Impact

Include Estimated Lookups
mailgun.org ~4

Omnisend uses Mailgun's full sending infrastructure, which includes both US and EU IP pools under separate sub-includes. This is one of the heavier SPF includes relative to the number of records it generates.