Mailjet lets you send before your domain is authenticated. Verifying a single sender address only proves you can receive mail at that address — it does not sign anything and does not satisfy DMARC. The setup that matters is domain-level: SPF authorisation, DKIM signing, then a policy that enforces both.
Step 1 — Authenticate the domain, not just the sender
- In Mailjet, open Account → Sender domains and addresses and add your domain.
- Mailjet returns DNS records to publish: a TXT record for DKIM under a selector, and an SPF entry. The DKIM value is generated for your account — copy it exactly rather than reconstructing it.
- Publish the records at your DNS provider. If the zone is behind Cloudflare, keep these on DNS only; a proxied record will not verify.
- Return to Mailjet and run verification. A partially verified domain still sends, but unauthenticated traffic will fail DMARC once you enforce.
Step 2 — Get SPF right
Mailjet's sending infrastructure is authorised with a single include in your SPF record:
v=spf1 include:spf.mailjet.com ~all
Keep the surrounding mechanisms you already need and do not create a second v=spf1 record — two records on one name is a syntax error, and receivers treat the whole lookup as failed. Every include costs one of the 10 DNS lookups SPF allows, so check the total with the SPF Checker before adding more senders.
Step 3 — Publish DMARC and read one cycle
Start with a monitoring policy and a reporting address:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
Aggregate reports show which IPs sent as your domain. For Mailjet traffic you should see DKIM pass with your own domain in d=. If the signature carries a Mailjet domain instead, domain authentication was never completed — the sender address was verified, nothing more.
After a full week of clean reports, move to p=quarantine; pct=10, confirm the quarantined volume matches sources you recognise, then raise pct and finally move to reject. Read the XML with the DMARC Report Analyzer and confirm the published policy with the DMARC checker.
Troubleshooting
SPF passes but DMARC still fails
That is the classic alignment failure. Mailjet may send the envelope from its own bounce domain, so SPF passes against Mailjet while the visible From domain is yours. DKIM is what closes the gap, which is why domain authentication is not optional.
Only some campaigns are affected
Check whether every campaign uses the same authenticated domain. A campaign sent from a different verified address, or through a subaccount with its own settings, can bypass the setup entirely.
Verification passes but headers show no signature
Authentication settings apply per sending domain. Confirm the message was actually sent through the domain you authenticated rather than through a legacy stream.
FAQ
Is verifying a sender address enough?
No. It confirms ownership of the mailbox. DKIM signing and DMARC alignment require domain authentication.
Can I send from a subdomain?
Yes, and it is often preferable. Authenticate the subdomain, publish its own SPF and DMARC records, and keep transactional and marketing reputation separate.
Do I need a separate DMARC record for Mailjet?
No. DMARC is per-domain, not per-provider. One record governs every sender using that domain, which is exactly why every sender must be authenticated before you enforce.
