SPF & DMARC

SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are DNS-based mechanisms that tell receiving mail servers which hosts are authorised to send email on behalf of your domain. Without them, emails are far more likely to land in spam or be silently discarded by the relay.

Required SPF record

Add the following TXT record to your domain's DNS at the apex (@):

v=spf1 include:mail.altermail-console.com.ng ~all

If your domain already has an SPF record, merge the include rather than adding a second TXT record (only one SPF record is allowed per domain).

Recommended DMARC record

Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Follow the recommended rollout:

Start with p=none — monitor mode. No emails are blocked; you receive aggregate reports at the rua address so you can see what's passing and failing.
After 2–4 weeks of clean reports, move to p=quarantine — failing emails go to spam instead of being rejected.
Once you're confident all legitimate senders are covered, tighten to p=reject — failing emails are outright rejected by the receiving server.

SPF not authorising Altermail: warnings in the API response

Altermail checks your domain's SPF record to confirm it includes include:mail.altermail-console.com.ng. If it doesn't (or no SPF record exists), the API still queues the email (returns 202) but includes a warnings array:

{
  "Status": "Queued",
  "dkimSigned": false,
  "warnings": [
    "yourdomain.com has no SPF record. Add a TXT record: \"v=spf1 include:mail.altermail-console.com.ng ~all\". Without it the relay may silently discard your emails."
  ]
}

If you already have an SPF record, don't create a new one, just add include:mail.altermail-console.com.ng to your existing record:

v=spf1 +a +mx +ip4:<your-server-ip> include:mail.altermail-console.com.ng ~all

Treat warnings as action items; the email may be silently discarded by the downstream relay if Altermail's mail servers are not authorised in your SPF record.

RELAY_REJECTED: silent discard detection

In rare cases the SMTP relay accepts the connection (returns 250 OK) but silently discards the message, usually because the domain's SPF record doesn't authorise our mail servers. When this happens, Altermail detects it and logs a RELAY_REJECTED entry in your delivery error log. The fix is always the same: add or correct your SPF record.

Checklist for maximum deliverability

✓SPF TXT record at apex includes mail.altermail-console.com.ng
✓DKIM TXT record added and confirmed in the Domains page
✓DMARC TXT record at _dmarc.yourdomain.com
✓No warnings array in the 202 API response
✓No RELAY_REJECTED entries in your delivery error log