This guide shows the DNS records iCloud Mail needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your iCloud Mail account where they differ — providers update them from time to time.
1. SPF record for iCloud Mail
Add iCloud Mail to your domain's SPF record. If you have no SPF record yet, create this TXT record on the root of your domain (host @):
v=spf1 include:icloud.com ~all
Already have an SPF record? Do not add a second one — insert include:icloud.com before the ~all / -all at the end of your existing record.
Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.
2. DKIM for iCloud Mail
In iCloud Mail, follow this path and publish the record it shows:
- iCloud → Custom Email Domain
- Follow the DNS records shown (includes the sig1 DKIM CNAME).
- Give DNS a few minutes, then confirm the record with the DKIM Checker.
The DKIM selector is usually sig1, so the record lives at sig1._domainkey.yourdomain.com. Enter that selector in the DKIM Checker to verify it.
3. DMARC
After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.
4. MX records
To receive email with iCloud Mail, your MX records must point to iCloud Mail's servers (host names containing mail.icloud.com). Copy the exact values from your iCloud Mail admin panel and check them with the MX Lookup.
Where to add the records
- Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
- GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
- Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
- Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
- Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.
Frequently asked questions
Do I need SPF, DKIM and DMARC for iCloud Mail?
Yes. Gmail and Yahoo require SPF and DKIM plus DMARC for bulk senders, and authenticated mail is far less likely to land in spam.
Can I have two SPF records?
No. Two SPF records make SPF fail. Combine all services into one record.
How do I check that iCloud Mail authentication works?
Run the Domain Checker, or send a message to Gmail and use "Show original" to see SPF, DKIM and DMARC results.
What is the DKIM selector for iCloud Mail?
Usually "sig1" — but use the selector shown in your iCloud Mail admin panel if it differs.