How to Set Up SPF and DKIM Authentication in Evox: Complete Setup Guide

TL;DR: Most SPF and DKIM guides explain the DNS theory and leave you to figure out the tool. This one walks IT company owners through the exact fields, record syntax, and error states inside Evox's authentication workflow, with a configuration checklist and error resolution matrix you can use on setup day.

What SPF and DKIM mean for your Evox campaigns

SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are DNS records that tell receiving mail servers your emails are legitimate. SPF lists the servers authorized to send on behalf of your domain. DKIM attaches a cryptographic signature to every outgoing message, letting the recipient's server verify the email wasn't altered in transit.

Without both records in place, your Evox campaigns land in spam or get rejected outright, regardless of how good your subject lines are. Gmail and Outlook now enforce sender authentication requirements, so this isn't a configuration detail you can defer.

Inside Evox, domain authentication connects directly to deliverability outcomes. Campaigns sent from an authenticated domain consistently reach the inbox. Campaigns sent from an unauthenticated domain get filtered before your open rate even registers.

A proper SPF DKIM setup in Evox also sets the foundation for DMARC, the policy layer that tells receiving servers what to do when a message fails authentication. Most guides treat DMARC as optional. It isn't, especially if you're sending cold outreach or high-volume nurture sequences where spoofing risk is real.

The next section shows exactly where to find the Evox domain authentication panel so you can start configuring both records today.

Find your Evox domain authentication settings

Log in to your Evox workspace, then open Settings from the left sidebar. Navigate to Organization Settings, then select Email & Domain Authentication. That's where the Evox domain authentication panel lives, including both SPF and DKIM configuration options.

If you manage multiple sending domains, each one gets its own authentication record. Select the domain you want to configure before generating any keys.

For DKIM configuration in Evox, the panel generates your public key and selector name automatically once you add your domain. Copy both values before leaving this screen — you'll paste them directly into your DNS provider in the next step.

One thing worth checking: confirm your sending domain matches the domain tied to your Evox workspace. A mismatch here causes verification to fail silently, and you won't see an error until you test a live send. For a broader Evox orientation, see how IT teams get the most from Evox's setup.

Configure your SPF record for Evox

SPF tells receiving mail servers which hosts are authorized to send email on behalf of your domain. Without it, messages sent through Evox are more likely to land in spam or get rejected outright.

The record Evox requires follows standard SPF record syntax for email marketing platforms. Add a TXT record to your domain's DNS with this value:

v=spf1 include:spf.evox.io ~all

Here's what each part does:

• v=spf1 declares this as an SPF record. Every SPF record starts here.

• include:spf.evox.io authorizes Evox's sending infrastructure for your domain. This is the mechanism your SPF DKIM setup in Evox depends on.

• ~all is a soft fail. Mail from unauthorized sources gets flagged but not outright rejected. Use -all (hard fail) only after you've confirmed all your sending sources are covered.

In Cloudflare, go to DNS > Records > Add record. Set Type to TXT, Name to @ (or your root domain), and paste the value above. In GoDaddy, find DNS Management under your domain settings and add a TXT record with Host set to @. Route 53 users add it under Hosted Zones > your domain > Create Record, choosing TXT as the record type.

If you already have an SPF record, don't create a second one. Merge the Evox include into your existing record:

v=spf1 include:spf.evox.io include:your-existing-sender.com ~all

Two SPF records on one domain causes a PermError, which fails authentication entirely.

DNS propagation for TXT records typically takes 15 minutes to a few hours on Cloudflare, and up to 48 hours on some registrars. Once propagation completes, Evox's domain authentication panel will show a green verified status next to your SPF record.

Generate and configure DKIM keys in Evox

DKIM authentication adds a cryptographic signature to every email Evox sends, so receiving servers can verify the message wasn't tampered with in transit. Here's how to generate and configure it.

Step 1: Generate your DKIM key pair in Evox

Inside Evox, go to Settings > Domain Authentication, select your verified domain, and click "Generate DKIM Keys." Evox creates a public/private key pair. The private key stays in Evox; you publish only the public key to DNS.

For key length, use 2048-bit. Some older DNS providers cap TXT record values at 255 characters, which can truncate a 2048-bit key — if yours does, split the key across two quoted strings in a single TXT record. 1024-bit is technically functional but no longer considered adequate for new setups.

Step 2: Copy the DKIM record to your DNS

Evox displays two values: a selector (typically something like evox1._domainkey) and a TXT value (the public key string starting with v=DKIM1; k=rsa; p=...).

In your DNS provider, create a new TXT record:

• Host/Name: the full selector Evox shows, e.g., evox1._domainkey.yourdomain.com

• Value: the complete key string, including v=DKIM1; k=rsa; p=

• TTL: 3600 seconds is a reasonable default

Step 3: Verify in Evox

Once DNS propagates (typically 15–30 minutes on Cloudflare, up to 48 hours on slower providers), return to Domain Authentication in Evox and click "Verify." A green status confirms your DKIM configuration is active and Evox domain authentication is complete for this record.

Add DMARC alongside SPF and DKIM in Evox

DMARC isn't required to send through Evox, but skipping it leaves a gap in your email deliverability authentication stack. SPF and DKIM prove your messages are legitimate; DMARC tells receiving servers what to do when they aren't.

Start with a none policy while your campaigns are live. This monitors without blocking anything:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Add this as a TXT record at _dmarc.yourdomain.com. The rua address receives aggregate reports, which show you how much of your mail is passing alignment before you tighten the policy.

Once reports confirm clean alignment across your Evox sends, move to quarantine, then reject over 30 to 60 days. Jumping straight to reject on a live campaign risks legitimate mail landing in spam or being dropped entirely.

The three policy values in plain terms:

• none: collect data, take no action

• quarantine: route failing mail to spam

• reject: block failing mail outright

For most IT company owners running active outbound, none for the first two weeks is the right call.

The Evox SPF/DKIM Configuration Checklist and Error Resolution Matrix

SPF configuration checklist

1. Log into your DNS provider and create a new TXT record at the root domain (@ or yourdomain.com).

2. Set the value to: v=spf1 include:spf.evox.io ~all

3. TTL: 3600 seconds is a safe default. Lower it to 300 if you want faster propagation during testing.

4. Save. Do not create a second SPF record. Multiple SPF TXT records cause a permanent error (permerror) that fails authentication silently.

DKIM configuration checklist

1. Inside Evox, go to Settings > Domain Authentication and generate your DKIM key pair.

2. Evox issues a 2048-bit key by default. Use it. 1024-bit is still technically valid but increasingly rejected by receiving mail servers.

3. Copy the CNAME or TXT record Evox generates. The selector follows the pattern evox._domainkey.yourdomain.com.

4. Add that record to DNS exactly as shown. Do not modify the value string.

Error resolution matrix

For Evox domain authentication to pass, both SPF and DKIM records must resolve cleanly before you trigger verification inside the platform.

Verify propagation and confirm authentication is working

DNS propagation for TXT records typically completes within 15–60 minutes on Cloudflare and AWS Route 53, though GoDaddy can take up to 4 hours. Wait at least 30 minutes before testing.

To confirm your DNS propagation email records are live, run your domain through MXToolbox or Google Admin Toolbox. Both show your published SPF and DKIM records and flag syntax errors immediately.

Once records are live, open Evox's domain authentication panel under Settings > Sending Domains. A passing result shows a green "Verified" status next to both SPF and DKIM. If either shows "Pending," the record hasn't propagated yet. If it shows "Failed," the value doesn't match what Evox expects — go back to the configuration checklist from the previous section.

When both entries show green, your Evox domain authentication is complete and your domain is cleared to send.

How authentication affects your Evox campaign deliverability

Without a correctly authenticated domain, Evox has no reliable path to the inbox. ISPs check SPF and DKIM records before deciding where your message lands, and a missing or broken record is enough to push an entire campaign into spam, regardless of how good the copy is.

Once your SPF DKIM setup Evox marks as verified, the practical difference shows up fast. Bounce rates drop because receiving servers stop rejecting mail from an unrecognized source. Inbox placement improves because your domain builds a sending reputation tied to authenticated traffic. And your campaign analytics get cleaner: opens, clicks, and replies reflect real engagement rather than the noise that comes from messages landing in junk folders.

There's a compounding effect worth noting. Each campaign you send through a verified domain adds to your domain's reputation score with major mailbox providers. That reputation carries forward, making future campaigns more likely to land well.

This also matters for how Evox reads your results. When email deliverability authentication is in place, the engagement signals Evox tracks, such as open timing and click patterns, are accurate enough to drive lead scoring and trigger follow-up sequences reliably. For a deeper look at how those signals feed into automated workflows, see how Evox Inbox Sync connects to multi-step email campaigns.

Closing

SPF and DKIM authentication in Evox aren't optional steps—they're the foundation that separates campaigns that land in inboxes from campaigns that land in spam. Once you've verified both records and confirmed green status in your Domain Authentication panel, your sending infrastructure is locked down. The next logical move is to wire up your first multi-step campaign and let Evox's analytics show you exactly what authentication unlocked. Head to our practical Evox setup guide for IT teams to see how authentication connects to your broader outbound workflow and campaign performance tracking.

FAQ