Bronto (Now part of NetSuite) SPF and DKIM configuration: Step By Step Guideline

This instructional article will demonstrate the NetSuite configuration process of Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) Signatures to ensure NetSuite passes the DMARC alignment check and eliminates spam from your domain and increases security.

The SPF record identifies the mail servers and domains that are allowed to send email on behalf of your domain. The DKIM record, on the other hand, is a specially formatted DNS TXT record that stores the public key the receiving mail server will use to verify a message’s signature. These email authentication methods will be used to prove to ISPs and mail services that senders are truly authorized to send email from a particular domain and are a way of verifying your email sending server is sending emails through your domain.

The process of configuring SPF

To establish SPF authentication for NetSuite, it’s important to note that NetSuite encompasses two distinct services: Email Infrastructure and Tax Infrastructure.

For further details regarding SPF configuration for these services, kindly refer to the table provided below:

1. Login and head to your DNS Zone provider
2. Create a new TXT record
3. Input the DNS name as @ or your domain name
4. Input the DNS value as v=spf1 include:mailsenders.netsuite.com ~all

Note: Based on the infrastructure you use, please make sure to include the correct SPF Value.

5. Save the record
6. Wait up to 72 hours to allow your DNS to process the changes

The screenshot below will show you an example of the SPF record. We’ll be using CloudFlare for this example.

Important Note: Each domain must have only one SPF TXT Record. If you have multiple SPF Records, SPF will return a PermError. 

If you are using multiple IPs, ESPs, Third-Party services for your various email strategies, you should include them in a single SPF Record.
E.g v=spf1 ip4:18.57.156.221 include:sent-via.netsuite.com include:thirdpartyservice.com ~all

The process of configuring DKIM

In order to authenticate NetSuite on DKIM, please follow these steps

1. Go to Setup > Company > Email > Email Preferences.
2. Click on the Domain Keys.
3. In the Domain Selector field, enter the first domain selector.
4. In the Domain Name field, enter your domain name
5. Click Generate Key Pairs to generate the DKIM keys
6. Click Generated DNS Entry

7. Head to your DNS zone

8.Create a new TXT record

9.Input the data based on the format below with your generated keys: Name: [selector]._domainkey

Note: Enter the Domain Selector name you entered in NetSuite with the ._domainkey suffix as the DNS record. For example, if you entered dec2023-netsuite in the Domain Selector field in NetSuite, at your domain provider, you would enter dec2023-netsuite._domainkey

Value: Paste the value you have generated after clicking the Generated DNS Entry

10. Save the record

Note: Please repeat the process in case you have another DKIM keys generated from the section 8 to 10.

The screenshot below will show you an example of the DKIM record. We’ll be using CloudFlare for this example.

In order to check and verify your DKIM keys, please follow these steps:

1. Head to your NetSuite dashboard
2. Head to Setup > Company > Email > Email Preferences
3. Click on Domain Keys and click on a row to edit the selector for the domain or subdomain.
4. Click on Active

5.Click on Save

6.Click on Verify DNS Entry and make sure your DNS Entry for DKIM is verified

Congratulations, you now successfully authenticated your outgoing mail stream from NetSuite with SPF and DKIM.