How to add SPF, DKIM & DMARC records in Squarespace Domains

Email authentication is three DNS records — an SPF TXT record, a DKIM record (usually a CNAME), and a DMARC TXT record. If your domain moved from Google Domains to Squarespace, you now add all three under the domain’s DNS settings as custom records. The Squarespace habit: use @ in the Host field for the root domain. This guide walks through each record with a worked example.

Written & reviewed by the VerifyAnyEmail team · Last reviewed July 2026

When Google Domains was retired, its domains moved to Squarespace Domains, so the interface changed but the records are identical. You don’t need to be technical — a DNS record is just a labelled line stating a fact about your domain, and for email you add three from one custom-records screen.

TXT vs CNAME, and “Host” vs “Data”

Two record types matter:

  • A TXT record holds text. SPF and DMARC are both TXT — the text is the policy.
  • A CNAME record is a pointer that says “for this name, look at that other name instead.” Mail providers usually give DKIM as a CNAME so they can rotate the key without you editing DNS again.

Squarespace labels the fields Host (the name) and Data (the value). The Host is where the record lives: @ means the root domain (example.com itself); anything else, like _dmarc, is a subdomain. The Data is what the record says.

1. Open the DNS settings

Sign in at Squarespace, go to Settings → Domains, click the domain, then open DNS (or DNS Settings). Scroll to Custom Records, where there’s a row to add a new record. Squarespace’s official help for custom DNS records is here. Everything below is done in Custom Records. (This applies to domains registered or managed by Squarespace; if the nameservers point elsewhere, edit records there.)

2. Add the SPF record (a TXT at the root)

SPF lists the servers allowed to send mail as your domain. In the Custom Records row, set:

  • Host: @ (the root domain)
  • Type: TXT
  • Data: v=spf1 include:_spf.google.com ~all

Click Add to save the row. Rule: only one SPF record. If a TXT with v=spf1 already exists (common if the domain still uses Google Workspace for mail), edit it and merge the new include: rather than adding a second. Build a clean string with the SPF Generator.

3. Add the DKIM record (usually a CNAME)

DKIM lets your provider sign each message. Your provider gives you the exact record — commonly a CNAME at a selector. In a new Custom Records row, set:

  • Host: the selector, e.g. selector1._domainkey (Squarespace appends your domain, so don’t type the full name)
  • Type: CNAME
  • Data: the target given, e.g. selector1-example-com._domainkey.provider.com

If your mail is Google Workspace, its DKIM is a TXT record at a google._domainkey selector — in that case choose Type TXT and paste the long v=DKIM1; k=rsa; p=… value into Data. Verify later with the DKIM Checker.

4. Add the DMARC record (a TXT at _dmarc)

DMARC ties SPF and DKIM to the visible From address and tells inboxes what to do on failure. In a new Custom Records row, set:

  • Host: _dmarc (no domain suffix — Squarespace adds it)
  • Type: TXT
  • Data: v=DMARC1; p=none; rua=mailto:dmarc@example.com

Start with p=none to monitor without affecting delivery, and point rua= at a mailbox you check. Generate one with the DMARC Generator and validate it with the DMARC Checker. When ready to enforce, follow moving DMARC to reject safely.

Squarespace-specific gotchas

  • Use @ for the root in Host. Squarespace appends your domain to whatever you type, so never include example.com in Host.
  • Ex-Google-Domains layout. If your domain migrated from Google Domains, the records carried over — you’re editing them in the new Squarespace UI, not starting from scratch.
  • Don’t disturb the preset records. Squarespace adds locked records for its own hosting; add your mail records alongside them, don’t delete theirs.
  • One SPF record only. Merge, don’t duplicate.

Verify propagation

After saving, confirm the records are visible worldwide with the DNS Propagation Checker, then check each individually with the SPF Checker, DKIM Checker and DMARC Checker. To confirm all three together, run the Email Health Check.

For what each record does and how DMARC alignment decides a pass, read the complete SPF, DKIM & DMARC guide. Using a different registrar? See the equivalents for Cloudflare, GoDaddy, Namecheap, AWS Route 53 and cPanel.

Check your domain in seconds

Run the free diagnostics referenced in this guide — no sign-up needed.