SPF and DKIM setup for Zuora

Zuora is an enterprise software company that provides a monetization platform for businesses to launch and manage subscription-based services.

This guide explains how to configure SPF and DKIM for Zuora to ensure your emails pass DMARC alignment checks, reduce the risk of spam, and enhance overall email security.

SPF Configuration

Zuora provides the following SPF record and recommends publishing it in your domain’s DNS zone:

v=spf1 mx a:zgateway.zuora.com -all

Note: If you already have an existing SPF record, simply include the Zuora mechanism (a:zgateway.zuora.com) within your current record.

Example:
Current SPF record:
v=spf1 include:_spf.google.com -all

Updated SPF record:
v=spf1 include:_spf.google.com a:zgateway.zuora.com -all

Email Delivery Options:
Zuora offers three different methods for sending email notifications on behalf of your organization:


1.Zuora Default Email Server

If you’re using Zuora’s default email server, only the SPF configuration (as shown above) is required.
Your emails will pass DMARC validation through SPF authentication.

When using an external SMTP server, follow Zuora’s official documentation for detailed steps on how to configure and connect your SMTP server to ensure your emails pass DMARC validation.

If you use Zuora’s Advanced SMTP server, the system will provide three CNAME records for DKIM during the initial setup.
You’ll need to publish these records in your domain’s DNS zone as instructed in Zuora’s official documentation.

DKIM Configuration

DKIM is supported only if you’re using one of the following methods for sending emails through Zuora:

1.External SMTP Server

2.Advanced SMTP Server

For both of these SMTP options, if you wish to configure DKIM for Zuora and not rely solely on SPF, we recommend reaching out to Zuora Global Support.

They can assist with advanced DKIM setup and verification on their side.

Important Note: Even if DKIM is not configured, SPF alone is sufficient for your emails to pass DMARC checks. DMARC validation requires at least one of the authentication methods (SPF or DKIM) to pass and align for successful delivery.

Note: If the provider recommends publishing also a DMARC record, there’s no need to do so if you already have a DMARC record in place, as each domain can only have one DMARC record.