Tencent Cloud Global Partner Onboarding Tencent Cloud DirectMail SPF and DKIM configuration guide

You’re here because you’ve already hit the real-world issues: messages landing in spam, authentication failures showing up in logs, or you need to pass customer email-security checks quickly without getting stuck in Tencent Cloud configuration loops. Below is a practical guide focused on decisions you’ll make during setup—covering the exact DNS records to add, common validation/risk-control pitfalls, and the operational side (account funding/renewal/payment methods) that often trips users up while troubleshooting email deliverability.

Tencent Cloud Global Partner Onboarding What you likely want to solve (and what breaks in practice)

• Tencent Cloud Global Partner Onboarding “SPF passes but emails still go to spam” — usually you edited SPF at the wrong domain, exceeded DNS TXT length limits, or your sending IP isn’t included in the SPF policy Tencent expects for your sending method.
• “DKIM status keeps showing ‘verification failed’” — common causes are wrong selector, using a different CNAME/record target than what DirectMail provides, or having an existing conflicting DKIM record.
• “I can’t find where the selector/records are in DirectMail” — sometimes you’re looking under the wrong project/region or the sending domain isn’t bound to the DirectMail channel yet.
• “I changed DNS, but validation doesn’t update” — TTL is too high, you’re querying cached resolvers, or Tencent validation is checking a different authoritative DNS view.
• “Account limitations prevent testing” — if your account is still under review or your sending permissions are restricted, SPF/DKIM changes won’t matter because mail traffic can’t proceed.

Before touching DNS: confirm your DirectMail sending domain and selector

Don’t start with DNS edits until you verify two things inside Tencent Cloud DirectMail for the exact sending method you’re using:

1. Sending domain: e.g., mail.example.com vs example.com. Many teams mistakenly configure SPF/DKIM for the root domain but actually send using a subdomain (or vice versa). DirectMail typically gives you record requirements tied to the domain you register/bind.
2. DKIM selector: Tencent provides a selector string (e.g., default or another label) and a corresponding value. DKIM records are selector-specific. If you use the wrong selector, Tencent will keep failing validation even if everything else is correct.

Operational tip: If you have multiple environments (staging/prod) using different subdomains, create separate domains in DirectMail. Then configure SPF/DKIM per domain. Reusing one domain across environments is a frequent reason for “it works in staging but fails in production.”

SPF configuration for DirectMail (TXT records that actually match)

In DirectMail deployments, the SPF goal is simple: ensure the sending infrastructure Tencent uses is authorized to send on behalf of your domain. Practically, you’ll add a single TXT record for SPF (or update the existing one correctly—no duplicate SPF records).

1) Locate your current SPF policy

Check existing TXT records for example.com (and also mail.example.com if that’s your sending identity). You’re looking for something like:

• v=spf1 ...

Do not add another SPF TXT if one already exists at that name. Multiple SPF records often cause unpredictable results and can fail strict validators.

2) Build/merge the SPF TXT following Tencent’s provided value

Tencent DirectMail will usually provide an include mechanism or a specific term you must place into your SPF. Your final SPF should:

• Start with v=spf1
• Include your necessary senders (e.g., your own mail server, if any)
• Add Tencent’s sending authorization as instructed
• Stay under SPF evaluation limits (too many mechanisms can cause soft-fail)

Example template (replace tokens with Tencent’s exact instructions):

v=spf1 include:tencent-spf-sender.example.net include:your-own-mx.example.com -all

If your domain already has an SPF record, merge carefully: keep existing authorized senders, then add Tencent’s term(s) the way Tencent documents. A common mistake is overwriting the SPF with only Tencent’s include, removing your own sender (marketing tools, in-house transactional service, etc.).

3) Set SPF at the correct hostname

If DirectMail sends with MAIL FROM / Return-Path alignment based on a particular hostname, SPF must exist at the matching domain. Teams frequently configure SPF on example.com while sending uses bounce.mail.example.com or another derived host.

Actionable check: After sending test mail, inspect the raw message headers (from the receiving mailbox you control). Confirm which domain the SPF result references. Then adjust SPF TXT placement accordingly.

DKIM configuration (the part that fails most often)

DKIM is where most “it should be right but validation fails” cases occur. The key is to create the exact CNAME or TXT record(s> Tencent specifies, using the correct selector and host.

1) Choose the record type Tencent tells you to add

Depending on DirectMail’s current setup, Tencent may provide DKIM configuration as either:

• CNAME (common for DKIM selectors)
• Tencent Cloud Global Partner Onboarding TXT (DKIM key record)

Don’t “convert” it yourself: if Tencent provides a CNAME method, using TXT instead can break verification. Use the record format they provide.

2) Create the DKIM record under the selector

DKIM record host generally looks like:

<selector>._domainkey.<your-sending-domain>

For example, if your selector is default and your domain is example.com:

default._domainkey.example.com

3) Use the exact value (no whitespace, no truncation)

For TXT DKIM, providers often show long strings. You must:

• Paste the full public key exactly
• Avoid line breaks and extra spaces
• Ensure the DNS UI isn’t adding quotes in the wrong place

For CNAME DKIM, ensure the target hostname matches Tencent’s provided domain exactly. DNS admin panels that “helpfully” append trailing dots can be harmless, but copying partially can cause failure.

4) Remove conflicting DKIM records

If you previously configured DKIM keys manually, you might already have a record at: <selector>._domainkey.<domain>. Replace it with Tencent’s DKIM target/value if Tencent instructs. Conflicts commonly happen after migrations from another ESP/provider.

Validation workflow: how to confirm SPF/DKIM are recognized (without guessing)

After DNS changes, you need confirmation steps that match how Tencent validates and how receivers cache results.

Step 1: Check DNS propagation realistically

• Verify the TXT/CNAME values at multiple resolvers (not only one online checker).
• Respect TTL. If you set TTL to 3600s, expect slow feedback.

If you’re in a hurry, temporarily lower TTL days before major changes (when possible), then restore after validation. This is a pragmatic approach I’ve used for production cutovers.

Step 2: Send a controlled test from DirectMail

Use DirectMail’s test sending or trigger a small number of messages. Keep content consistent so you can focus on authentication headers.

Step 3: Inspect SPF/DKIM results in receiver headers

On receiving mailboxes you control, confirm:

• SPF: pass/neutral/fail and which domain evaluated
• DKIM: “d=” domain alignment and the selector that matched

Why receiver headers matter: Tencent may report “verified” based on DNS lookup, but mailbox providers can still apply stricter rules (DMARC alignment, reputation, volume patterns).

DMARC/Alignment: the missing step that makes SPF/DKIM look “irrelevant”

Even if SPF and DKIM both pass, some corporate receivers treat misaligned identities harshly. If your domain uses DMARC, ensure alignment rules match how DirectMail signs.

Practical approach:

• Check your DMARC record (_dmarc.example.com).
• If you’re not using DMARC yet, consider enabling it after SPF/DKIM proof to reduce deliverability risk.
• If you are using DMARC, verify whether the RFC5322 From and DKIM d= alignment are correct for your DirectMail setup.

Account prerequisites: SPF/DKIM troubleshooting often fails due to DirectMail permissions

Many teams spend hours editing DNS only to discover their DirectMail configuration is blocked by account risk controls, KYC status, or sending restrictions. SPF/DKIM records don’t fix those operational blockers.

Identity verification (KYC) expectations you should plan for

When you provision or activate email sending with a new Tencent Cloud account (or a new business entity), you may face identity verification requirements:

• Individual vs Enterprise: in practice, enterprise verification is more consistent for higher-volume sending and longer-term usage.
• Document mismatch: names, company registration info, or contact emails must be consistent with the account profile.
• Repeated submissions: multiple re-verifications can trigger additional risk scrutiny.

Common failure reasons I’ve seen in operational reviews:

• Uploaded ID or business license image is blurry or cropped (OCR fails).
• Account holder and payment contact mismatch.
• Company address/registered entity information differs from what was provided during signup.
• Mismatch between domain ownership contact and verified sender identities (indirectly impacts deliverability risk reviews).

Risk control and compliance review triggers

Tencent Cloud may apply additional checks around email sending, including:

• New domain + sudden volume: if you bind a brand-new domain and immediately send large batches, you may get throttled.
• Template changes + high bounce risk: frequent template edits can be flagged if it looks like spam behavior.
• Unverified sending identity: if sender address format doesn’t match the domain you configured for SPF/DKIM/DMARC, risk systems may restrict sending.

Actionable mitigation: Start with low-volume tests after SPF/DKIM are in place, then ramp gradually. This reduces the likelihood you’ll be stopped by throttling while DNS validation is still settling.

Cloud account purchasing, funding, and renewals: what matters for staying operational

If you bought access recently (or inherited an account), delivery troubleshooting often collides with account funding state. A “working DNS” setup won’t deliver mail if the account is suspended, limited, or expired subscription.

Tencent Cloud Global Partner Onboarding Purchasing/activating the account (what to check first)

• Account status: ensure DirectMail can be used (not pending activation, not blocked by verification).
• Project/region alignment: DirectMail resources can be scoped; make sure you’re configuring the same project where sending happens.
• Billing mode: confirm whether you’re in pay-as-you-go or prepaid (affects how you recover from a funding gap).

Payment methods: differences that affect operations

Payment method choice can influence speed of funding and how quickly you can recover from a failed top-up. In practice:

Practical recommendation: If you’re running transactional/production campaigns, keep a small buffer balance to avoid throttling during DNS troubleshooting and ramp-up phases.

Renewals and usage restrictions

Common outcomes when renewal is missed or account is limited:

• Sending stops or fails with billing-related errors
• New domain binding might be blocked until verification and billing are resolved
• Tencent Cloud Global Partner Onboarding Rate limits tighten, which looks like “deliverability regression” even though DNS is correct

If you’re debugging SPF/DKIM, log the time you changed DNS and compare with your send logs. If sends started failing right after a billing/renewal boundary, prioritize billing checks before reconfiguring DNS again.

Cost comparisons: SPF/DKIM is cheap—what really costs you is failure loops and downtime

Tencent DirectMail SPF/DKIM configuration itself costs nothing in DNS terms, but operational cost comes from repeated verification loops, delayed ramp-up, and support time.

Compare “do it once” vs “trial-and-retry”

• Do it once: carefully configure SPF (single TXT), correct DKIM selector/record type, send low volume tests, then ramp.
• Trial-and-retry: multiple SPF TXT records, wrong selector, DMARC mismatch, or account funding blocks. Each failure extends time to production and increases spam reputation risk.

Hidden cost drivers you can control

• DNS TTL: higher TTL slows your feedback loop.
• Multiple domains/environments: each needs its own SPF/DKIM verification.
• Account review timing: if KYC/enterprise verification is delayed, you’ll lose valuable windows for campaigns.

I typically advise teams to set DNS TTL to a lower value (when feasible) before the first cutover, and to keep the “first week ramp plan” small to avoid being throttled.

Troubleshooting FAQ (answers to the exact questions people search)

Q1: Can I configure SPF and DKIM on both apex domain and subdomain?

Yes, but only configure where DirectMail actually authenticates the sender. If you send from mail.example.com, configure SPF/DKIM for that domain/hostname. Don’t blindly add records to multiple names without confirming the sending identity, or you’ll complicate alignment.

Q2: Why does SPF fail after I added Tencent’s include?

• You added SPF TXT at the wrong hostname.
• Your domain already had SPF TXT records (duplicate SPF) and the receiver used the wrong one.
• Tencent Cloud Global Partner Onboarding The include term is incomplete or you truncated it in the DNS UI.
• You’re exceeding SPF limits (too many mechanisms), leading to soft-fail/neutral outcomes.

Q3: DKIM validation keeps failing—what’s the fastest diagnosis?

Verify selector + host + record type. Then:

• Confirm the exact selector name matches DirectMail’s provided selector.
• If Tencent gave CNAME, ensure you used CNAME (not TXT).
• If TXT, ensure the key value is copied exactly with no whitespace changes.
• Check for conflicting records at the same selector hostname.

Q4: How long does it take for SPF/DKIM to “work”?

DNS propagation depends on your authoritative TTL and caching resolvers. In real operations, plan for anywhere from minutes to a few hours. If you changed TTL properly, you can get faster feedback—otherwise validation may appear stuck.

Q5: Does Tencent Cloud account KYC affect SPF/DKIM?

Not technically. SPF/DKIM are DNS-side. But practically, if your account isn’t fully verified or sending is restricted, you won’t generate enough test emails to validate deliverability. That creates the illusion that SPF/DKIM are broken.

Q6: I bought an account—can I use DirectMail immediately?

Don’t assume. If the account is in an active risk-control state, or identity verification is incomplete, DirectMail may not allow domain binding or sending. Check account status and verification first, then proceed with DNS.

Q7: What are common reasons for DirectMail “domain verification” failure?

• Incorrect DNS record format (TXT vs CNAME mismatch)
• Wrong selector or using an old selector from a previous setup
• DNS record exists but points to an old value after you migrated providers
• DNS values not updated at authoritative nameservers

Tencent Cloud Global Partner Onboarding Scenario-based setup playbook (what I’d do in your shoes)

Scenario A: New domain + first-time DirectMail setup (avoid reputation damage)

1. Bind the domain in DirectMail and grab Tencent’s exact SPF/DKIM requirements for that specific domain.
2. Edit DNS once:
   • SPF: update the existing SPF TXT (no duplicates) and include Tencent’s term.
   • DKIM: add the record using the exact selector and record type.
3. Set up DMARC carefully if you already have it; otherwise plan to enable after authentication passes.
4. Send small test volume and confirm SPF/DKIM headers before ramping.

Scenario B: SPF passes but DKIM fails (most common migration issue)

1. From DirectMail, confirm selector.
2. Check DNS record at <selector>._domainkey.<domain>.
3. Ensure you didn’t replace a CNAME with TXT (or vice versa).
4. Remove/replace conflicting records from prior ESPs.
5. Retry test sending and validate receiver headers (not just DNS lookup tools).

Scenario C: Everything looks correct, but sending is blocked

1. Check account status and any risk-control notifications.
2. Verify KYC/enterprise verification completion.
3. Tencent Cloud Global Partner Onboarding Confirm billing balance/renewal state and payment method success.
4. Run a small test after unblocking; don’t continue changing DNS repeatedly while the root cause is account limitation.

Fast checklist (use this before submitting another “why doesn’t it work?” ticket)

• SPF: single SPF TXT at the correct hostname; includes Tencent term; no duplicates.
• Tencent Cloud Global Partner Onboarding DKIM: correct selector; correct record type (CNAME vs TXT); exact value copied.
• DNS: record exists on authoritative nameservers; TTL considered.
• DirectMail binding: domain in the same Tencent project where you send.
• Account: KYC/enterprise verification done; sending not throttled by risk control or billing issues.
• Receiver confirmation: check SPF/DKIM results in message headers.

FAQ about purchasing, funding, and compliance (so your delivery doesn’t stall)

Will funding problems cause authentication to fail?

No. Authentication is DNS/email signing logic. But funding problems can stop sending, which means you won’t get new traffic to validate SPF/DKIM and deliverability.

Tencent Cloud Global Partner Onboarding Do payment methods impact risk reviews?

They can indirectly. For example, if an account is flagged for high risk, adding funds through some payment paths may trigger extra checks. Operationally, ensure your billing identity and verified business/contact info match.

What’s the safest way to plan a production launch?

Use a ramp plan: DNS configured first, then low-volume tests, then gradual scaling. In parallel, confirm KYC status and keep a funding buffer so you don’t hit an operational pause during ramp-up.

Questions for you (so I can tailor the record targets)

If you want, paste the following (redact only sensitive values):

• Sending domain you bound in DirectMail (apex or subdomain)
• Whether Tencent provided DKIM as CNAME or TXT
• Your current SPF TXT content (or at least the mechanisms)
• Your receiver type (Gmail/Office365/other) and the header snippet showing SPF/DKIM result

With that, I can point out exactly where most misconfigurations happen (wrong hostname, selector mismatch, duplicate SPF, or record-type swap).