How to Set Up SPF, DKIM, and DMARC for Multiple Domains

You run one mail server for domainA.com and domainB.com. Both domains send mail through the same IP. You have SPF, DKIM, and DMARC records published. You expect everything to pass. Then domainB.com starts failing DMARC checks and you have no idea why.

This is one of the most common email authentication problems in multi-domain setups. The individual records might be correct, but the interaction between them across domains creates edge cases that generic single-domain guides do not cover.

The core issue is that SPF, DKIM, and DMARC all behave differently when multiple domains share infrastructure.

SPF for Multiple Domains One Mail Server

SPF checks the RFC5321.MailFrom domain (the envelope From) against the client IP. When all your domains send from the same mail server, the SPF record is structurally the same across all of them.

The 10-Lookup Rule and How to Stay Under It

RFC 7208 limits SPF to 10 DNS lookups per check. In a multi-domain setup where each domain includes its own copy of the same third-party senders (CRM tools, marketing platforms, helpdesk systems), you can hit that ceiling faster than you think.

The fix is not to repeat the same include statements across every domain. Instead, create one SPF record per domain that includes only the mechanisms relevant to that domain, and share the same mail server IP across all of them.

Example for domainA.com:

v=spf1 ip4:203.0.113.10 include:mail.domainA.com include:sendgrid.net ~all

Example for domainB.com (different third-party senders, same mail server):

v=spf1 ip4:203.0.113.10 include:mail.domainA.com include:hubspot.com ~all

Both domains reference mail.domainA.com as the primary include, which points back to the shared server IP. Third-party senders are added per-domain as needed. This keeps lookup counts low while allowing flexibility per domain.

SPF Syntax When All Domains Use the Same Mail Host

If all domains send only from your mail server and no third-party senders are involved, the simplest form works for every domain:

v=spf1 ip4:203.0.113.10 ~all

Add include:mail.domainA.com in every domain that needs to reference the shared server. Do not publish different IPs for different domains if they all use the same server. That mismatch will cause SPF hardfail on whichever domain has the wrong IP in its record.

DKIM for Multiple Domains

DKIM signs the message with a private key. Receivers decrypt it using the public key published in DNS. The critical rule for multi-domain setups is that the DKIM signature must cover the domain in the RFC5322.From header. If domainB.com sends but the DKIM signature only covers domainA.com, DMARC alignment fails.

One Selector Per Domain vs One Selector for All Domains

Most mail servers support either:
1. Per-domain selectors - generate a new DKIM key pair and selector for each sending domain. More work to manage, but clean separation.
2. Shared selectors - one DKIM key pair used to sign for multiple domains. Less management overhead, but requires the mail server to add the appropriate From-domain headers before signing.

Option 1 is safer for MSPs and multi-tenant setups where customer domains must not be influenced by each other.

Option 2 works when a single operator controls all sending domains and can guarantee the From header before signing.

How to Generate and Publish DKIM Keys Across Domains

For each domain, generate a 2048-bit DKIM key pair. Publish the public key as a TXT record at selector._domainkey.domain.com.

Example for domainB.com with selector "mail":

mail._domainkey.domainB.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA..."

Your mail server uses the corresponding private key to add the DKIM-Signature header to outgoing mail. The signature covers the canonicalized body and selected headers.

The most common failure in multi-domain DKIM setup is forgetting that subdomain From addresses also need their own DKIM records if the parent domain's DKIM does not cover subdomains. If domainB.com sends from subdomain.domainB.com, check that the DKIM selector covers subdomain.domainB.com or is configured to sign for all subdomains.

DMARC Alignment Across Domains

DMARC has two alignment checks: SPF alignment and DKIM alignment. Both compare the domain in the RFC5321.From (SPF) or RFC5322.From (DKIM) against a known authenticated domain.

In a multi-domain setup, the trap is having DKIM pass for one domain while the From header shows another. This causes DKIM alignment to fail even though DKIM itself is working.

Why DMARC Fails Even When SPF and DKIM Pass

SPF passes: your server IP is authorized for the envelope domain.
DKIM passes: the message was signed with a valid key.
DMARC fails: the RFC5322.From domain does not match the DKIM signing domain.

This happens when domainB.com sends through domainA.com's mail server but the DKIM key was generated for domainA.com. The From header says domainB.com, the DKIM signature says domainA.com. They do not align.

The fix requires either:

Publishing DKIM keys for each domain separately and configuring the mail server to sign with the correct per-domain key, or
Using a shared DKIM selector that the mail server is configured to use for all From domains

Subdomain Policy (sp=none vs sp=reject)

If only some subdomains of a parent domain send mail, use sp=none to monitor before enforcing:

_dmarc.domainA.com. 300 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@domainA.com"

If some subdomains send and others do not, set sp=none and use a separate record for sending subdomains:

# Parent domain policy _dmarc.domainA.com. 300 IN TXT "v=DMARC1; p=none; sp=quarantine; rua=mailto:dmarc@domainA.com" # Sending subdomain override _dmarc.sending.domainA.com. 300 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@domainA.com"

Only move to p=reject when aggregate reports confirm no legitimate mail sources are misaligned.

Monitoring Aggregate Reports Across Many Domains

This is where multi-domain setups become operationally painful. Each domain needs its own rua target. When you have 10 domains sending mail, you get 10 separate aggregate report feeds. Without a central collector, that means 10 email inboxes or 10 portal logins to check every time you want to know the authentication health of your domains.

The triage problem gets worse as the number of domains grows. A single failure in one domain might be visible in that domain's reports but easy to miss if you are not checking all of them regularly.

DMARCFlow solves this by giving you one dashboard that collects aggregate reports from every domain you add.

For MSPs managing email authentication for multiple customers, this means one login, one view, no per-customer portal setup required.

Common Mistakes in Multi-Domain Setup

Mistake 1: Publishing the same SPF record for every domain without checking lookup counts. When you add a new third-party sender to one domain, do not copy it to all domains blindly. Track which domain includes what.

Mistake 2: Using one DKIM key for all domains without configuring the mail server to sign all From domains. If the server only signs with domainA.com's key, domainB.com will fail DMARC even if the key is valid.

Mistake 3: Setting p=reject on all domains before reviewing aggregate reports. Aggregate reports tell you which sources are legitimately sending on your behalf. Enforcing p=reject without that data risks blocking real mail.

Mistake 4: Forgetting that subdomains need their own DKIM selectors if they send mail. Subdomains are independent for DMARC purposes.

Mistake 5: Not monitoring aggregate reports at all. A DMARC record with p=none and no rua target tells you nothing about who is sending mail on your behalf.

FAQ

Can one mail server handle SPF for dozens of domains?
Yes. Each domain publishes its own SPF record pointing to the same server IP. There is no limit on how many domains can reference the same mail server in SPF. The limit is on DNS lookups per record, which you manage per domain.

Do I need a separate DKIM key for each domain?
Ideally yes. Each domain should have its own DKIM key pair and selector. This keeps domains independent. If one domain's key is compromised, the others are not affected. It also makes DKIM alignment cleaner for DMARC.

What happens if my domains have different sending IPs?
Then your SPF records differ per domain. Each domain includes only the IPs that actually send mail for it.

How do I keep track of DMARC reports for 20 domains?
Use a centralized aggregate report collector. DMARCFlow consolidates reports from all your domains into a single dashboard. You set one rua endpoint per domain pointing to DMARCFlow, and all report traffic is aggregated in one place.

Can I use the same DKIM selector for all my domains?
Only if your mail server is configured to sign all From domains with that selector. If the server signs with selector X for domainA.com but domainB.com's From header does not match, DMARC alignment fails.