How to set up SPF, DKIM and DMARC on Wix domains

The principle is simple: your email provider generates the values, you paste them into Wix. Everything happens in one screen: Domains → the Domain Actions icon next to your domain → Manage DNS Records, then + Add Record in the TXT (Text) or CNAME (Aliases) section. Wix itself publishes no SPF or DKIM value of its own — its SPF article for Google Workspace is one sentence and a link to Google. What this guide gives you is where to click, what goes in which field, and the three Wix-specific traps. Checked against the official documentation on 5 September 2026.

These three records let receiving mail servers check that a message claiming to be from you really is from you. They do not guarantee your email reaches the inbox — your content and sending reputation matter at least as much — but without them, anyone can send email in your name.

What we don't do: we never touch your DNS zone. We read, we prescribe, you paste. You're the one who saves it, in your own Wix account, with your own credentials.

Before anything else: is Wix actually holding your DNS?

Wix repeats this warning at the top of every DNS article, so take it seriously: "If your domain is connected to Wix via pointing, you must manage your DNS records with your domain host (not Wix)."

Two situations, and only one of them belongs on this page:

• Your domain was bought from Wix, transferred to Wix, or connected via name servers. Wix hosts your DNS. "Domains purchased from Wix or transferred to Wix are automatically connected by name servers." Your name servers look like ns14.wixdns.net / ns15.wixdns.net — Wix's own example — and this guide applies.
• Your domain is connected via pointing. You only changed an A record and a www CNAME at your registrar; everything else stayed there. In Wix's words: "your domain's DNS records stay with your domain's host." The records below don't change — only the panel does. Go add them at GoDaddy, Namecheap, Cloudflare or wherever your name servers point.

If you don't know which one you are: the Manage DNS Records option is simply missing for a pointed domain. Wix's FAQ: "If your domain is connected via pointing, you won't be able to manage your DNS records from your Wix account."

Two things Wix rules out. You cannot edit the NS records of a Wix domain ("It is not possible to update the name server (NS) records for a Wix domain"), and "Wix does not support the use of DNSSEC or DNS Proxies like Cloudflare." If you were hoping to hand your DNS to Cloudflare while keeping the Wix site connected by name servers, that isn't a supported combination.

The records to copy and paste

1. SPF — who is allowed to send as you

What you must replace: the include:, almost certainly. The line above is Google's published value for Google Workspace — the mailbox Wix resells as "Business Email" — not a Wix value. Use whatever your own mail provider publishes:

If several services send on your behalf, they all go in one single line:

v=spf1 include:_spf.google.com include:spf.example-crm.com ~all

⚠️ One SPF record per domain. Always. Two v=spf1 lines don't mean double protection, they mean no SPF at all — not for the new tool, and not for the mailboxes that worked yesterday. When you add a sending tool, you edit the line you already have: hover over the existing TXT record and click Edit.

Use the TXT section, not the SPF section. Wix's DNS panel still shows a separate SPF record section, and Wix itself tells you not to use it: "The SPF record type is no longer used by all platforms. For this reason, it's best to add SPF records in the TXT section of your DNS records." A record saved in the SPF section may simply be ignored by receiving servers.

Leave Host Name blank for the root domain. Google's instructions say to enter @. Wix's instructions say: "Leave this field blank if your provider tells you to add @ here." Both mean the same thing — a blank field is your bare domain.

2. DKIM — the signature on your messages

Wix does not generate your DKIM key. Whoever sends your email does, and the value is unique to your account. Wix's own DKIM article says so: "You need to get the DKIM record from your email provider." Copy it; never invent it.

Google Workspace — one TXT record, generated in the Google Admin console under Menu → Apps → Google Workspace → Gmail → Authenticate email → Generate New Record, with the default selector google:

What you must replace: the whole p= part — it's generated for your domain. Wix's instruction is literally "Enter the DKIM selector under Host Name" and "Enter the DKIM signature under Value". Once saved, go back to Authenticate email and click Start authentication.

Microsoft 365 — two CNAME records, both name and value generated in the Microsoft Defender portal. Add them in the CNAME (Aliases) section, Host Name = the part before your domain, Value = the target Microsoft shows.

⚠️ Never trust a tutorial that hands you a ready-made Microsoft 365 DKIM value. Since May 2025, Microsoft uses a new CNAME format for custom domains added after that date, with a partition character assigned dynamically — it is genuinely impossible to guess.

Wix Email Marketing — if you send campaigns from your own domain, Wix authenticates it with a set of CNAME records shown in your site dashboard (Email Marketing → Manage Senders → Authenticate this domain). On a domain hosted at Wix this "should happen automatically"; on an external domain you copy them yourself. One of those records deserves its own paragraph — see DMARC.

On long keys: Wix states the DKIM "key bit length can be either 2048 or 1024". A 2048-bit key runs past 255 characters; if Wix's Value field refuses it, Google's fallback is a 1024-bit key.

3. DMARC — the instruction you give to inboxes

What you must replace: YOU@YOUR-DOMAIN.com with an address you actually read. That's where your reports land, and a DMARC record without a rua= is a report you'll never see.

Why p=none first. It means "watch and tell me". Nobody gets blocked, nothing changes for your recipients, and you start receiving a list of everything sending in your name — including the tools you'd forgotten about. You watch for two to four weeks, confirm every legitimate sender is recognised, and only then tighten one notch to p=quarantine, then p=reject. Google agrees: "When you start using DMARC, we recommend setting the policy option (p) to none."

⚠️ One DMARC record per domain too. If you already have one, you edit it. And that "if" is bigger on Wix than elsewhere — read on.

Check first whether Wix already put something on _dmarc. Wix's Email Marketing FAQ answers the question "Will authenticating my custom domain… mean that my DMARC record will also be set up?" with: "Yes, with the CNAME 5 record, your DMARC record for your custom domain will automatically be set up." Read that carefully: the record is a CNAME, an alias to a record Wix controls. Wix's documentation doesn't say which policy that record carries or where its reports go. On the Wix-hosted domains we looked up while writing this guide, the alias resolved to a p=none policy with a reporting address belonging to Wix's provider — not to the site owner. Your domain answers "DMARC: configured" to any checker, and you have never seen a single report.

Two consequences. First, you can't add your own TXT next to it: the DNS panel will answer Hostname already in use — Wix's documented error when "there may be another record added elsewhere that uses the same host name." Second, to get your reports, you replace the alias with your own TXT record: More Actions → Delete on the _dmarc CNAME, then + Add Record in the TXT section with the value above. The CNAMEs that sign your campaigns are separate records and stay where they are.

Google's example is a bad one to copy. Google's DMARC article illustrates the record with v=DMARC1; p=reject; …; pct=100; adkim=s; aspf=s. It starts at p=reject before you've read a single report, and pct= was removed from the DMARC standard by RFC 9989 (May 2026) — servers following the current standard ignore it. Take Google's advice (start at p=none), not its example.

The click path

On your email provider's side — get the values. Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate New Record; SPF is the fixed line above. Microsoft 365: Defender portal → Email authentication settings → DKIM. Wix Email Marketing: site dashboard → Email Marketing → Manage Senders → Authenticate this domain. Keep that tab open.

On the Wix side — create the records:

1. Go to Domains in your Wix account.
2. Click the Domain Actions icon next to the relevant domain.
3. Click Manage DNS Records.
4. Scroll to the record type you need — TXT (Text) for SPF, DKIM-as-TXT and DMARC; CNAME (Aliases) for DKIM-as-CNAME — and click + Add Record. For a CNAME, click Got it in the pop-up first.
5. Fill in Host Name (prefix only, blank for the root domain) and Value.
6. Click Save, then Save Changes in the pop-up.
7. Repeat for the next record. Wix is explicit: "You can only edit one DNS record at a time. Save your changes before adding another record."

To edit an existing record — your current SPF line, for instance — hover over it and click Edit. To delete one, click the More Actions icon to its right, then Delete, then Delete Record. Wix's warning applies to its own default records: "Deleting your domain's default A or CNAME records may cause your site to go offline." Your TXT records aren't on that list.

On TTL: Wix's advice is to leave it alone — "We recommend leaving the TTL setting for your DNS records at the default value" — and "changing the TTL value does not speed up the time it takes for a DNS record to propagate."

Back on your provider's side — verify. Google: Authenticate email → Start authentication. Wix Email Marketing: refresh Sender Details and read Domain status.

If your mailbox is Google Workspace bought from Wix: Wix already handled the MX records — "the MX records are automatically added to your domain's DNS records (unless you're connected by pointing)." SPF, DKIM and DMARC are not part of that automation. They're yours to add.

The 3 mistakes we see most often here

1. Believing your DMARC is done because a checker says so

You have a Wix domain, you use Email Marketing, and every scanner shows a DMARC record. Except it's Wix's alias, at Wix's policy, reporting to Wix's provider. You'll find out someone is sending in your name the day a customer forwards you the phishing email — never from a report.

How you spot it: in Manage DNS Records, _dmarc sits in the CNAME (Aliases) section, not in TXT (Text). Or your attempt to add a _dmarc TXT is refused with Hostname already in use.

The fix: delete the alias, publish your own TXT with a rua= you read. Same p=none — you lose nothing, you gain the reports.

2. Saving the SPF in the SPF section, or saving a second one

Wix's panel offers an SPF section right below TXT. It's the deprecated SPF record type, and Wix's own article tells you not to use it. A line saved there looks fine in the panel and may never be read by a receiving server. The cousin mistake: your provider asks for include:something.com, so you add a new TXT record next to the existing v=spf1 line — two SPF records, and SPF stops working entirely, for your mailboxes too.

How you spot it: a scan reports "no SPF found" while you can see one in Wix (wrong section), or "multiple SPF records" / permerror (second line).

The fix: one v=spf1 line, in the TXT (Text) section, all your include: values inside it. Hover → Edit on the existing line rather than + Add Record.

3. Reading Wix's FAQ and deciding DMARC isn't for you

Wix's deliverability article answers "Can I use DMARC for email authentication?" with: "In most cases we recommend a combination of SPF and DKIM records… This should prove more effective for email authentication at Wix than only using DMARC." Then: "If your organization sends more than 5000 emails per day, however, you must use DMARC." A reasonable reader concludes DMARC is a high-volume-sender thing.

It isn't. SPF and DKIM say who may send as you. DMARC is the only one of the three that tells inboxes what to do with everyone else — and the only one that reports back to you. A ten-person business with no newsletter needs it exactly as much as a bulk sender.

How you spot it: you have SPF and DKIM, no _dmarc record, and a good reason for it that came from a help page.

The fix: publish v=DMARC1; p=none; rua=mailto:… today. Nothing changes for your recipients; everything changes for what you can see.

How long before it takes effect

• In Wix: saved as soon as you click Save Changes.
• On the internet: Wix's figure, repeated across its articles, is "up to 48 hours" for propagation. In practice most changes resolve much faster.
• For Google Workspace: "It can take up to 48 hours for SPF authentication to start working", and the same 48 hours for DKIM. On a brand-new account, Google adds: "you must wait 24–72 hours before you can get your DKIM key in the Admin console."
• For Wix Email Marketing: "it can take a few hours for the records to propagate… allow up to 24 hours."
• For DMARC reports: the first ones arrive 24 to 72 hours after you publish, then roughly once a day.

Wait an hour before clicking any "verify" button, then wait again. Clicking twelve times in five minutes only adds doubt.

Further reading

• How to set up SPF, DKIM and DMARC on Squarespace domains
• How to set up SPF, DKIM and DMARC on GoDaddy
• How to move your DMARC policy to p=reject safely
• My emails go to spam even though SPF, DKIM and DMARC pass