DMARC, SPF and DKIM on Wix, step by step

Before you start: where your domain's DNS lives

If you bought the domain from Wix, or connected it to Wix with name servers, you add the records in Wix: Domains › the Domain Actions icon next to the domain › Manage DNS Records.

If the domain is connected to Wix by pointing, you add the records where you bought the domain, not in Wix. The values are the same.

You also need to know who runs your email: Google Workspace, Microsoft 365 or someone else. It's whoever bills you for the mailboxes, and it's often Google Workspace bought through Wix itself.

Step 1: SPF, who may send email as you

In the TXT section, click + Add Record. Leave the host name empty and paste your email provider's value:

• Google Workspace: v=spf1 include:_spf.google.com ~all
• Microsoft 365: v=spf1 include:spf.protection.outlook.com -all

There can only be one SPF record. If one starting with v=spf1 already exists, don't create another: add the new include: to the existing one, before the ~all or -all. With two, mail servers treat SPF as broken. We found broken SPF (duplicated or too long) on 1 in 17 sites.

How to merge two SPF records and cut down the lookups

Step 2: DKIM, the signature on your emails

The DKIM key is generated by your email provider and pasted into Wix. Wix accepts 2048-bit keys.

Google Workspace:

1. In the Google Admin console, open Apps › Google Workspace › Gmail › Authenticate email.
2. Pick the domain and generate a new record with a 2048-bit key.
3. In Wix, in the TXT section, add a record named google._domainkey with the value Google shows (it starts with v=DKIM1).
4. Go back to the Google Admin console and click Start authentication. Without this click, the key is published but your emails still go out without your domain's signature.

More detail, and what to do if it fails: the Google Workspace DKIM guide

Microsoft 365:

1. In the Microsoft Defender portal, open Email authentication settings › DKIM and pick your domain.
2. In Wix, in the CNAME section, add the two records Microsoft shows: selector1._domainkey and selector2._domainkey, each with the value given.
3. Go back to Defender and turn on DKIM signing for the domain.

More detail, and what to do if it fails: the Microsoft 365 DKIM guide

Another provider: search its help for “DKIM”. The process is the same: a TXT or CNAME record with the name it gives you.

Step 3: DMARC, what to do with fake email

In the TXT section, add:

Type

TXT

Name (host)

_dmarc

Value

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

In the name, type only _dmarc: if you type the full domain, many panels end up repeating it. Replace the address in rua= with a mailbox of yours: that's where mail servers send daily reports (technical files you can ignore at first).

p=none only watches: it doesn't stop anything yet, but it doesn't put your genuine email at risk either. After 2 to 4 weeks, with SPF and DKIM right, switch to p=quarantine: from then on, fake email in your name goes to spam.

When and how to move to p=quarantine

Step 4: confirm it worked

DNS changes can take up to 48 hours to reach everywhere. Then check the domain again: for each point, “Show the evidence” shows the record exactly as we read it in DNS, so you can compare it letter by letter.

While DMARC is at p=none, Excubitor shows it as “Can wait”: it's the next step, not an emergency.

Mistakes we see often

• Two SPF records, for example an old one and one from Google. Merge them into one.
• The full domain in the DMARC record's name, which ends up repeated. _dmarc is enough.
• The DKIM key published in Wix without clicking “Start authentication” in Google.
• Jumping straight to p=reject without SPF and DKIM right: your own emails can be refused.

What if emails still go to spam?

With SPF, DKIM and DMARC right, your domain is set up correctly. If messages still land in spam, the cause is usually reputation: how much you send at once, how many people mark it as spam, and the quality of your list. Google Postmaster Tools shows how Gmail sees your domain.

So you don't have to check again

Records change without warning: someone switches email provider, a technician deletes a record by mistake. Excubitor can watch the domain every week and email you only when something changes. Free for 1 domain: run the check and press “Notify me”.

Guide: Shopify store emails going to spam