How to Set Up SPF, DKIM & DMARC for Multiple Domains

If you send email from more than one domain through the same mail server, you will eventually hit a problem: one domain authenticates fine and the others fail for reasons that are not obvious. This is the most common failure mode in multi-domain email authentication, and it has a specific cause that is fixable.

This guide covers how to configure SPF, DKIM, and DMARC for multiple domains on one mail server without breaking any of them.

How Email Authentication Works in 60 Seconds

Three protocols protect email senders and receivers from forgery.

SPF (Sender Policy Framework) publishes which mail servers are allowed to send email for a domain. A DNS TXT record lists IP addresses or hostnames. Receiving servers check whether the sending server's IP is on that list.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. The receiving server verifies the signature against a public key published in DNS. If the signature is valid, the email was not altered in transit and was sent by someone with access to the private key.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together with an alignment rule. For DMARC to pass, at least one of SPF or DKIM must authenticate AND the authenticated identity must align with the From domain. Alignment means the domain used in the SPF check or DKIM signature must match the visible From address domain.

That last part is what trips up most multi-domain setups.

Why One Mail Server Breaks DMARC Alignment

Here is the specific problem.

When you send from multiple domains through one server, SPF typically works fine: you add the server's IP to each domain's SPF record. DKIM also usually works: you sign each domain with its own key. But DMARC alignment fails because of how the From domain interacts with the authenticated identifier.

The From domain is what the recipient sees. The SPF authenticated identifier is the domain that appears in the MAIL FROM or HELO. The DKIM authenticated identifier is the domain in the DKIM-Signature header (the "d=" tag).

DMARC alignment requires that either the SPF domain or the DKIM domain matches the From domain. If you route mail through a shared server or relay, the MAIL FROM domain or the DKIM signing domain may not match the From domain, and DMARC fails even when both SPF and DKIM pass individually.

Step 1: Configure SPF for Multiple Domains

Each domain needs its own SPF record. The records do not have to be identical. What matters is that each domain lists the mail servers that actually send its email.

Common setup: one IP address sends for all domains.

``Domain A: v=spf1 ip4:203.0.113.10 -all Domain B: v=spf1 ip4:203.0.113.10 -all Domain C: v=spf1 ip4:203.0.113.10 -all`


This works for SPF. The same IP appears in every record, which is correct if the same server handles all outbound delivery for all domains.
What does not work: using a third-party ESP's include mechanism in one domain's SPF but not another's, then wondering why that domain's emails fail. If one domain sends through your server and another sends through an ESP, they need different SPF records.
If your server also receives mail for these domains, make sure the MX record points to the same server listed in the SPF record. A common mistake is having SPF say one server but MX say another, which causes authentication failures on inbound mail flow that SPF was never meant to cover.
Step 2: Configure DKIM for Multiple Domains
DKIM signing for multiple domains requires either one key pair per domain or one key pair with multiple selector records.
The simplest correct setup uses separate selector records per domain.
On your mail server, you generate a private key and a public key for each sending domain. The public key gets published as a DNS TXT record under a selector name you choose.
Selector naming matters when you have multiple domains. A common pattern:

`Domain A: selector._domainkey.domainA.com Domain B: selector._domainkey.domainB.com`


The mail server signs outgoing email for each domain using that domain's private key. The receiving server looks up the public key at the selector domain and verifies the signature.
If you use the same selector name for multiple domains, keep the signing keys separate. The selector name is just a lookup pointer. The key pair is what matters for security. Sharing the same private key across domains is technically workable but makes key rotation harder and is not recommended.
One DKIM key pair can cover a parent domain and its subdomains if they use the same sending infrastructure. But two unrelated domains sharing one private key is an operational risk.
Step 3: Configure DMARC Alignment for Multiple Domains
DMARC alignment is where multi-domain setups most commonly fail.
The DMARC record looks like this for a domain starting out:

`_dmarc.domainA.com. IN TXT "v=DMARC1; p=none; rua=mailto:reports@domainA.com"`


The alignment rule is built in. For DMARC to pass:

SPF alignment: the MAIL FROM domain must match the From domain exactly (or be an authorized subdomain, if aspf=s is set to relaxed)

DKIM alignment: the d= domain in the DKIM signature must match the From domain exactly (or be a subdomain, if adkim=r is set to relaxed)

The default is strict alignment (aspf=s, adkim=r). This means the domains must match exactly, not approximately.


For multi-domain setups, the most common failure is the MAIL FROM domain not matching the From domain when mail is routed through a relay or sent via a shared submission service. If you are sending through a shared service, the MAIL FROM often defaults to the service's domain, not yours. That breaks SPF alignment immediately.
Solutions:
Use a dedicated MAIL FROM subdomain for each domain. Most mail servers let you set a custom envelope-sender domain per sending domain. Set it to match your From domain or a subdomain of it.
Use DKIM signing as the primary alignment mechanism. If DKIM alignment passes, DMARC passes regardless of SPF alignment. For domains where SPF is difficult to control, ensure DKIM signing is working correctly and the signing domain matches the From domain.
Start with p=none, monitor, then move to p=quarantine. Before enforcing policy, read your DMARC reports to understand what is actually failing and why. Moving to p=reject before understanding your report data means you may silently lose email.
Monitoring Multi-Domain DMARC: What to Watch For
When you manage multiple domains, manual DMARC report review becomes impractical. Each domain generates aggregate reports, and parsing XML files manually across five or ten domains is how teams miss real failures.
The patterns you are looking for in aggregate reports:

One domain suddenly shows SPF alignment failures while the others are clean. This usually means the SPF record for that domain was updated but the change has not propagated, or the MAIL FROM configuration drifted.
DKIM signature failures on one domain only. The DNS record for that selector may have been modified, or the mail server stopped signing for that domain.
Both SPF and DKIM failing for all domains at the same time. This typically means the sending server's IP address changed and all SPF records are now pointing to a wrong address.

DMARCFlow handles multi-domain monitoring by connecting to all your domains and pulling aggregate reports automatically. The dashboard shows per-domain pass/fail rates in one view, so you know which domain has a problem without checking each one separately. During server migrations, when one domain's SPF record changes, you see the failure immediately instead of waiting for a user complaint.
If you are currently managing this manually, the first sign of trouble is usually a complaint from a customer. By then, you have already lost email.
Troubleshooting: Why Do My Emails Still Fail
SPF passes but DMARC fails. This is almost always an alignment problem. SPF is authenticating the MAIL FROM domain, but that domain does not match your From domain. Switch to DKIM alignment as your primary mechanism, or fix the MAIL FROM domain.

DKIM passes but DMARC fails. The DKIM signing domain does not match the From domain. Check the d=` tag in your DKIM signature and compare it to your From domain. If you are signing with a parent domain but sending from a subdomain, alignment fails.

Both SPF and DKIM pass but DMARC reports alignment failures. This happens when your From domain uses a subdomain but your MAIL FROM or DKIM domain uses the apex domain, or vice versa. DMARC treats these as different domains.

All authentication passes but email still goes to spam. Authentication is about sender verification, not deliverability. A valid SPF/DKIM/DMARC setup does not guarantee inbox placement. It only guarantees the receiving server knows the email actually came from you.

Quick Reference Checklist

[ ] Each domain has its own SPF record listing the correct sending server IP
[ ] Each domain has its own DKIM private key and publishes the matching public key in DNS
[ ] The DKIM signing domain matches the From domain exactly
[ ] The MAIL FROM domain matches the From domain or a subdomain of it
[ ] DMARC alignment uses strict mode by default; change to relaxed only when you understand the implications
[ ] DMARC aggregate reports are being collected and reviewed
[ ] Start at p=none, monitor for at least 2 weeks, then move to p=quarantine
[ ] After p=quarantine shows no business email loss, move to p=reject
[ ] Use a monitoring tool to track all domains in one view

FAQ

Can one mail server handle DKIM for multiple domains?
Yes. Most mail servers support multiple DKIM signing domains. You configure each domain with its own selector and private key. The server signs each outgoing message with the correct key based on the From domain.

Why does forwarded mail fail DMARC?
Forwarding services typically rewrite the From domain or change the MAIL FROM, which breaks SPF or DKIM alignment. This is a known limitation. The forwarded email appears to come from the forwarder's domain, not yours. This is why DMARC alignment matters: your legitimate forwarded emails may fail authentication if the forwarder does not handle DKIM signing.

Can I use the same DKIM key for multiple domains?
You can, but you should not. Using separate keys per domain means that if one key is compromised, only that domain is affected. Shared keys create unnecessary risk and make key rotation more complicated.

What happens when I move a domain to a new mail server?
Update the SPF record for that specific domain before the migration. The DKIM key can usually stay the same if you are keeping the same sending infrastructure. After migration, read your DMARC reports to confirm both SPF and DKIM are passing for the moved domain.