# How do I configure SPF and DKIM for Chargebee?

> Configure SPF and DKIM for Chargebee two ways: enable Chargebee Domain Authentication, or send through your own SMTP provider. Step-by-step, with a DMARC check.

## Quick Takeaways

- Chargebee sends billing emails (invoices, receipts, dunning) from its own servers by default, so your domain has no SPF or DKIM control until you authenticate.
- Path 1: enable Chargebee Domain Authentication. Chargebee then signs your outgoing mail with your DKIM signature.
- Path 2: connect your own SMTP provider (Postmark, SendGrid, or Amazon SES) and authenticate SPF and DKIM there.
- In its default setup Chargebee does not sign mail for your domain, which is why messages fail on a strict DMARC policy.
- Domain Authentication is arranged through Chargebee Support, not from a self-serve screen. Chargebee emails you the DNS records to publish.
- Add the exact SPF and DKIM records Chargebee or your SMTP provider gives you. Never copy values from another domain.
- Confirm the result with a [DMARC check](/tools/dmarc) before you rely on it.

Chargebee handles your billing email, so the same records that authenticate the rest of your domain need to cover Chargebee too. Otherwise invoices and payment reminders can fail authentication and land in spam.

## Why do Chargebee emails fail SPF and DKIM by default?

Out of the box, Chargebee sends notifications from its own infrastructure. Your SPF record does not list Chargebee, and Chargebee does not sign the message with your domain's DKIM key. Chargebee's documentation is explicit that it "does not support signing mails with other domains while sending" in that default state. If your domain publishes a DMARC policy of quarantine or reject, those unauthenticated messages can be filtered or blocked. Authentication closes that gap.

## What are my two options for authenticating Chargebee email?

You have two supported routes:

1. **Domain Authentication.** Keep using Chargebee's SMTP server and let Chargebee sign outgoing mail with your DKIM signature.
2. **Your own SMTP server.** Route Chargebee's mail through a provider where you already control SPF and DKIM, such as Postmark, SendGrid, or Amazon SES.

Both can satisfy DMARC. The right one depends on whether you want to keep Chargebee's servers or consolidate sending inside a provider you already run.

![Two ways to authenticate Chargebee email: Domain Authentication, where Chargebee signs DKIM for your domain, versus your own SMTP server, where your provider handles SPF and DKIM.](/images/figures/configure-spf-dkim-chargebee-fig1.webp)

## How do I set up Chargebee Domain Authentication?

Domain Authentication lets Chargebee sign your mail with your domain's DKIM signature while still sending from Chargebee's servers. Set it up like this:

1. Contact Chargebee Support to start domain authentication. It is not a self-serve toggle in the admin panel.
2. Before onboarding, remove any sender profiles tied to the chargebee.com domain, and remove sender profiles for domains where you do not control DNS.
3. Chargebee emails you the DNS records to publish. Add each one to your DNS host exactly as provided.
4. After onboarding finishes, Chargebee "will automatically start signing your emails with your DKIM signature."

Chargebee recommends this route when your DMARC policy is set to quarantine or reject, when you send from Australia or Europe, or when you need to meet Google and Yahoo sender requirements.

## How do I add an SPF record for Chargebee?

SPF authorizes a sender to use your domain. During domain authentication, add the exact SPF value Chargebee provides to your domain's TXT record. Two rules keep it valid:

- If you already publish an SPF record, merge the Chargebee entry into that single record. A domain can have only one SPF record.
- Stay under the SPF 10-lookup limit, or receivers will return a permerror. You can confirm this with the [SPF checker](/tools/spf).

Use the string Chargebee gives you rather than copying an include from another provider, since the authorized sender differs by setup.

## How do I authenticate through my own SMTP server instead?

If you would rather keep authentication inside a provider you already run, point Chargebee at your own SMTP server:

1. In Chargebee, open Settings and go to Email Notifications under Configure Chargebee, then choose to send through your own SMTP server.
2. Enter your provider's hostname, username, password, encryption type, and port. For SendGrid, use "apikey" as the username and your SendGrid API key as the password.
3. Because the mail now leaves your SMTP provider, authenticate SPF and DKIM in that provider's dashboard. For example, verify your domain in Postmark or SendGrid and publish the SPF and DKIM records it lists.

This path gives you full SPF and DKIM control, and it is the route Chargebee points to when DMARC is already enabled on your domain.

## Which option should I choose?

Domain Authentication is the simplest if you want to keep Chargebee's servers and only need DKIM signing on your domain. Your own SMTP server is the better fit when you already run a sending provider, want a single place to manage authentication, or enforce a strict DMARC policy across every source.

## How do I confirm SPF and DKIM are working?

Send a test invoice or notification to a Gmail or Outlook address, then open the message headers and look for spf=pass and dkim=pass. For a full view, run your domain through [Palisade's Email Security Score](/tools/email-security-score), which reports SPF, DKIM, and DMARC together. You can also spot-check individual records with the [SPF](/tools/spf) and [DKIM](/tools/dkim) tools. Once every source authenticates, Palisade can host your records and move the domain to an enforced DMARC policy of p=reject.

## Frequently Asked Questions

### Can Chargebee sign email with my domain's DKIM key?

Yes, through Domain Authentication. Once Chargebee finishes onboarding your domain, it signs outgoing mail with your DKIM signature. Without it, Chargebee does not sign for your domain.

### Do I need my own SMTP server to pass DMARC?

Not always. Domain Authentication can satisfy DMARC because it adds your DKIM signature to Chargebee's mail. Use your own SMTP server when you prefer to manage authentication inside a provider you already control.

### Why do my Chargebee emails go to spam?

Usually because they are unauthenticated. Until SPF authorizes the sender and DKIM signs the message, mailbox providers treat the mail as unverified and may filter it.

### Can I set up Domain Authentication myself in the admin panel?

No. Chargebee arranges domain authentication through its support team, then sends you the DNS records to publish yourself.

### What SPF value should I use for Chargebee?

Use the exact value Chargebee gives you during onboarding, or the value your SMTP provider lists if you send through your own server. Merge it into your existing SPF record so the domain keeps a single TXT entry.

## Related reading

- [How do I set up SPF and DKIM for SendGrid?](/learning/how-do-i-set-up-spf-and-dkim-for-sendgrid)
- [Google is making email sender requirements stricter starting Nov 2025](/learning/google-is-making-email-sender-requirements-stricter-starting-nov-2025)