SPF record for Stripe

Stripe sends invoices, receipts and failed payment notices to your customers. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Stripe publishes no include for your root record. Its custom email domain page, checked on 2026-09-04, lists three kinds of record and the Dashboard generates all of them. A TXT proves you own the domain, a CNAME sets the Mail From domain, and CNAMEs hold the DKIM keys.

Stripe states one limit on that page in plain terms: strict SPF alignment is not supported, so your DMARC record must not carry aspf=s. Relaxed alignment is the default, and leaving aspf out of the record altogether is the same thing.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS-querying mechanisms across the whole nested chain, and going over turns the record into a permerror that authorises nothing. Our free SPF checker resolves the chain and gives you the number.

DKIM

The DKIM records are CNAMEs under names Stripe generates for your account, so there is no selector to print here. Publish them exactly as the Dashboard gives them, and watch the Name field: Stripe's troubleshooting says some DNS providers append your domain themselves, which is how a record ends up carrying it twice.

A CNAME has to be the only record at its name. A leftover TXT at the same host from an earlier attempt stops the CNAME resolving, and Stripe reports the record as missing while the panel shows it sitting there.

Return path and SPF alignment

The Mail From CNAME is the record that gives you SPF. It puts a subdomain of yours in the envelope sender, so the SPF pass lands on your domain instead of Stripe's and aligns with your From address under relaxed matching. Take it from Customer emails in the Dashboard with the others.

DMARC alignment with Stripe

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Stripe specifics:

• Stripe wants a DMARC record on the domain before it will send customer email from it, and suggests starting at p=none for monitoring.
• The mailbox names are a fixed list: billing, invoice, receipts, support and a few more. You choose the domain, not the part in front of the at sign.
• Replies go to the support address in your public business information rather than to the address the message came from. DMARC is unaffected, because it reads the From domain.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Stripe to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Stripe's own documentation, at Stripe documentation. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.