Set up SPF, DKIM, and DMARC on DreamHost
Add SPF, DKIM, and DMARC at DreamHost under Websites → Manage Websites → DNS Settings: click Add Record, hover the TXT Record section and click ADD, leave the Host field blank for the root domain, and enter the value without quotes.
Where to add records on DreamHost
DreamHost panel (panel.dreamhost.com) → left sidebar Websites → Manage Websites → find your domain's card/row and open its DNS Settings (in Grid view, click the vertical 3-dot button under the domain and choose 'DNS Settings'; in List view, click the 3-dot button at the far right and choose 'DNS Settings'). On the DNS records page, click 'Add Record', then hover over the 'TXT Record' section and click the 'ADD' link. (Alternative path: Manage Websites → 'Manage' button → 'DNS' tab → Add Record.)
- In the DreamHost panel (panel.dreamhost.com), open Websites → Manage Websites in the left sidebar.
- Find the domain and open its DNS Settings: in Grid view click the vertical 3-dot button under the domain (in List view, the 3-dot button at the far right) and choose 'DNS Settings'. (Or click 'Manage' and open the 'DNS' tab.)
- On the DNS records page click the 'Add Record' button, then hover over the 'TXT Record' section and click the 'ADD' link.
- In the 'Host' field, leave it BLANK for a root-domain record (apex SPF/DMARC), or enter only the subdomain label (e.g. '_dmarc' for DMARC, or 'selector._domainkey' for an external DKIM key) — never append your domain name; DreamHost adds the domain (and a trailing dot) automatically.
- Paste the full record into the 'TXT Value' field with NO surrounding quotation marks, and double-check there are no stray spaces (a space inside a DKIM key makes the record fail validation).
- Click the 'Add Record' button to save. The record appears in the list; allow up to ~6 hours to propagate (occasionally longer), then verify with an external SPF/DKIM/DMARC lookup tool.
The three records on DreamHost
SPF Sender Policy Framework
Leave the Host field BLANK for the root SPF record — DreamHost treats a blank Host as the apex and auto-inserts @; do not type '@' or your domain. DreamHost auto-publishes a default SPF (v=spf1 mx include:netblocks.dreamhost.com include:relay.mailchannels.net -all). You may only have ONE SPF record, and your custom TXT supersedes DreamHost's default, so to authorize a third party add a single TXT that re-includes DreamHost's servers plus the new one, e.g. v=spf1 mx include:netblocks.dreamhost.com include:relay.mailchannels.net include:_spf.google.com -all. Note: if your domain uses Google Workspace, DreamHost locks the SPF field and you cannot edit it in the panel.
DKIM DomainKeys Identified Mail
DreamHost automatically generates and publishes DKIM for any domain/subdomain that uses DreamHost email — you'll already see a TXT record named 'dreamhost._domainkey' (DreamHost uses 2048-bit keys); no manual step is needed for DreamHost-sent mail. For a third-party sender (Google Workspace, an ESP, a sending platform), add THEIR DKIM as a new TXT record: in the 'Host' field enter only the selector label, e.g. 'google._domainkey' or 'selector1._domainkey' (DreamHost appends your domain automatically — don't type the full host), and paste the provider's public key into 'TXT Value' without quotes. Critical DreamHost trap: strip any spaces from the pasted key — DreamHost will accept a key containing spaces but DKIM validation will then fail.
DMARC reporting and policy
Add a TXT record with the 'Host' field set to exactly '_dmarc' (NOT '_dmarc.yourdomain.com' — DreamHost appends the domain for you), and a 'TXT Value' like v=DMARC1; p=none; rua=mailto:dmarc_agg@yourdomain.com. DreamHost recommends starting at p=none for at least a week to collect aggregate reports without affecting delivery, then tightening to p=quarantine (and later p=reject) once SPF and DKIM are passing and aligned. (DreamHost's own documented example is v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_agg@example.com; ruf=mailto:dmarc_forensic@example.com; pct=100.)
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
DreamHost gotchas
- Root = leave the Host field BLANK, not '@'. DreamHost auto-inserts the @ (and a trailing dot) when Host is empty; typing '@' or the domain name creates a wrong/literal host. For subdomain records (_dmarc, selector._domainkey) enter only the label, never the full FQDN — DreamHost auto-appends the domain.
- There is NO 'Type' dropdown. You choose the record type by hovering the matching section ('TXT Record') and clicking its 'ADD' link; the host field is labeled 'Host' and the value field 'TXT Value' (required, asterisked). Save with the 'Add Record' button — the old 'Add a custom DNS record to [domain]' form with a Type dropdown and 'Add Record now!' button has been replaced.
- Don't wrap TXT values in quotation marks, and watch for stray spaces — DreamHost stores the value as entered. A space inside a DKIM public key is the classic trap: the record saves fine but every DKIM check fails.
- No TTL field — DreamHost assigns a fixed default TTL to records you add; you can't set or lower it in the panel. DreamHost cites up to ~6 hours to propagate (full global propagation can occasionally take 24–48h); verify with an external SPF/DKIM/DMARC lookup, not just the panel.
- Only ONE SPF record is allowed, and a custom SPF supersedes DreamHost's auto-added default — always consolidate into a single root SPF that re-includes DreamHost (mx include:netblocks.dreamhost.com include:relay.mailchannels.net) if you still send through DreamHost. On Google Workspace domains the SPF field is locked/uneditable in the panel.
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on DreamHost get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.