MailerMonk
    01Free tools
    02Backlink agent03How it works04Pricing
    Sign inStart free trial
    PrivacyTerms
    Chapter · SPF for Fastmail
    Revised 17 Jun 2026
    Guide · SPF · Fastmail

    How to set up SPF for Fastmail.

    Fastmail is a privacy-oriented business mail provider. Their DKIM CNAMEs are the cleanest of any major ESP — three records, fixed names, point at hosted keys.

    Afsan Rahmatullah
    Afsan RahmatullahMailerMonk

    SPF (Sender Policy Framework, RFC 7208) authorizes specific servers to send mail for your domain. When you start sending through Fastmail, you must publish a single SPF record at your domain apex that includes Fastmail's sending infrastructure — otherwise the messages will fail SPF, your DMARC checks will fail, and your mail will land in spam or be rejected outright.

    If you already publish SPF for another sender (Google Workspace for inbound, a marketing tool, your CRM), do not publish a second record. Merge the new include into the existing record. RFC 7208 §3 forbids multiple SPF records on the same name and receivers MUST return permerror when they see one.

    Publish these DNS records

    Add the following record(s) to your domain's DNS zone. Most registrars (Cloudflare, Route 53, Namecheap, GoDaddy) accept values exactly as shown.

    Record · TXT
    Type
    TXT
    Host
    @
    Value
    v=spf1 include:spf.messagingengine.com ?all
    Why this matters
    • Fastmail recommends `?all` (neutral) on apex SPF for domains that send through multiple providers. Use `~all` or `-all` if Fastmail is your only sender.

    Where in Fastmail

    The SPF configuration lives in Fastmail → Settings → Domains → <your-domain> → Authentication.

    Verify the records

    Once published, run the SPF Checker on your domain to verify the lookup chain expands cleanly and stays under the 10-DNS-lookup limit.

    From a terminal
    dig +short TXT your-domain.com
    Run the free SPF checker

    Common pitfalls

    Pitfall
    • Fastmail expects you to publish their MX records as well; without MX pointing at `in1-smtp.messagingengine.com` and `in2-smtp.messagingengine.com`, inbound mail won't reach the mailbox even if SPF/DKIM/DMARC are fine.
    • Fastmail's masked-email feature uses a different sending IP pool. Outbound from masked addresses still aligns with your domain DKIM if you've configured custom domain sending.
    After you publish

    Want to know if it actually keeps working?

    MailerMonk continuously watches your SPF record, aggregate DMARC reports, and inbox placement — and pings you the moment something drifts. Free for the first domain.

    Start free trial

    About the author

    Afsan Rahmatullah
    Afsan Rahmatullah
    MailerMonk

    Building tools that keep cold email out of spam. Writes about deliverability, DMARC, and what actually moves inbox placement.

    Related · Fastmail

    Other records for Fastmail