MailerLite domain authentication failed: fix DKIM and SPF records step by step

What MailerLite is checking

You add a sending domain in Account settings > Domains > Add domain, then either use automatic authentication (for partner DNS hosts) or add the records by hand. MailerLite shows a name and value for each record and says the records cannot be changed inside MailerLite, so what you enter at your DNS host must match exactly. A custom sending domain has to be authenticated to send, except during the first 14 days of a new account. [1]

Fix 1: the domain was added twice

Most DNS panels add your domain to the end of whatever you type in the name field. If you paste litesrv._domainkey.yourdomain.com, the published record becomes litesrv._domainkey.yourdomain.com.yourdomain.com and MailerLite cannot find it. MailerLite says that in most cases you should not add the domain to the name, and should enter just litesrv._domainkey. [2]

The same problem can happen in the value field. MailerLite says some providers append the domain to the value by default, and that adding a period at the end, litesrv._domainkey.mlsend.com. , prevents it. It also suggests pasting your record and MailerLite's side by side in a text comparison tool to spot differences. [2]

Fix 2: two SPF records instead of one

MailerLite says you can only have one SPF record in your DNS zone. If your domain already has one for Google Workspace, Microsoft 365 or a web host, adding a second v=spf1 record breaks SPF. Merge them into one record by including every service without repeating mechanisms; a merged record usually has more than one include statement. [2] [5]

MailerLite's example merged record is v=spf1 a mx include:spf.protection.outlook.com include:_spf.mlsend.com ~all. Its troubleshooting guide adds that when you click Check DNS records, MailerLite checks the record and updates the SPF value it shows you to a merged version, and that SPF records are case-sensitive. [2] [5]

• Delete every existing SPF record, including any unmerged MailerLite one. [2]
• Create one new TXT record at @ with the merged value. [2]
• Keep the record under 255 characters per string, and under 10 DNS lookups from include or redirect mechanisms; remove services you no longer use. [2]
• Click Check DNS records again. [2]

Fix 3: Cloudflare proxy and CNAME flattening

MailerLite's Cloudflare instructions set the DKIM record as a CNAME named litesrv._domainkey with target litesrv._domainkey.mlsend.com, proxy status off (DNS only) and TTL on Auto. [3]

Cloudflare's own documentation warns that if you turn on flattening for all CNAME records, a CNAME used by a third-party service to verify your domain may fail, because the CNAME itself is no longer returned. MailerLite's guides do not mention flattening, but if you have enabled it zone-wide, that warning applies to the DKIM CNAME. [6]

MailerLite also says that if approval fails on Cloudflare, check that your Cloudflare nameservers match the ones configured at your registrar or host. If they do not, Cloudflare is not the DNS host that the internet is reading. [3]

Fix 4: wrong DNS host, or not enough time

MailerLite says propagation is usually complete within 24 hours but can take up to 72, and suggests a public DNS checker to watch progress. If records still have not appeared after 24 to 48 hours, confirm you added them at the platform that actually manages your DNS. [1] [2]

On Namecheap, MailerLite says these records can be added in Advanced DNS only when the domain uses BasicDNS, PremiumDNS or FreeDNS. If it uses Namecheap Web Hosting DNS, add them in cPanel instead. [4]

For the verification TXT record, MailerLite says the value must be added in full, not shortened, and the name must be your root domain. [2]

Checklist: Namecheap

• Domain List > Manage > Advanced DNS. [4]
• CNAME: Host litesrv._domainkey, Value litesrv._domainkey.mlsend.com, TTL Automatic. [4]
• TXT: Host @, Value the SPF value from MailerLite; delete any other record starting v=spf1. [4]
• TXT: Host @, Value the verification value from MailerLite. [4]
• Save all changes, wait, then click Check DNS records in MailerLite. [4]

Checklist: Cloudflare

• CNAME: Name litesrv._domainkey, Target litesrv._domainkey.mlsend.com, Proxy status DNS only, TTL Auto. [3]
• TXT: Name @ (or your subdomain), Content the SPF value from MailerLite; keep only one v=spf1 record. [3]
• TXT: Name @, Content the verification value. [3]
• If you flatten all CNAMEs, review Cloudflare's verification warning. [6]
• Confirm the registrar uses the Cloudflare nameservers, then recheck in MailerLite. [3]

When to ask MailerLite support

If records match exactly, a DNS checker shows them worldwide, and MailerLite still fails after 72 hours, contact support. MailerLite says paid customers can reach Support from inside their account; free-plan users are pointed to its Customer Self-Service Center. Include screenshots of each record and the exact error shown in the Domains tab. [2]

Sources & verification

Product details and prices can change. Check the linked provider before buying.

1. MailerLite Help: How to verify and authenticate your domain Accessed 30 Oct 2026
2. MailerLite Help: Troubleshooting domain authentication Accessed 30 Oct 2026
3. MailerLite Help: How to authenticate a domain with Cloudflare Accessed 30 Oct 2026
4. MailerLite Help: How to authenticate a domain in Namecheap Accessed 30 Oct 2026
5. MailerLite Help: How to merge SPF records Accessed 30 Oct 2026
6. Cloudflare DNS docs: CNAME flattening Accessed 30 Oct 2026