DNS help › Wix

How to add SPF, DKIM and DMARC records in Wix

If you bought your domain through Wix, or connected it to Wix using Wix's nameservers, you manage DNS records from the Domains page of your Wix account.

This guide shows where to find your DNS settings, how to add or change a record, and what the main email records do.

Before you start

Wix says that if your domain is connected to Wix by pointing, you add or update TXT records with your domain host instead of Wix.

Step 1: Log in and find your DNS settings

1. Go to Domains in your Wix account.
2. Click the Domain Actions icon next to the domain.
3. Select Manage DNS Records.

Step 2: Add a TXT record

1. In the TXT (Text) section, click + Add Record.
2. In Host Name, enter the host. Leave it blank where other guides say @.
3. In Value, paste the record text.
4. Click Save.

About the Name field: Wix uses a blank Host Name for the domain itself. Where other guides say @, leave the Host Name empty. For anything else, enter just the prefix, for example _dmarc.

Changing an existing record

To change a record, hover over the TXT record, click Edit, enter the new value and click Save.

Adding a CNAME record

For a CNAME record (Microsoft 365 uses these for DKIM), use the CNAME section on the same Manage DNS Records page.

The same steps work for the Tidy Cyber ownership record: Name _tidycyber-verify, with the code we show you when you verify. The code is unique to you and your domain.

Step 3: Understand your email records

These are the records our check looks at. If one already exists, it usually needs editing rather than adding another.

SPF: say who can send email for you

SPF is a single TXT record on your domain that lists the services allowed to send email as you, such as your email provider, newsletter tool or invoicing system. Without it, it's much easier for a scammer to send email that looks like it came from you.

A domain can only have one SPF record, so if you already have one, it needs editing rather than adding a second. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DMARC: tell the world what to do with fakes

DMARC is a TXT record that tells other mail servers what to do with email that fails the SPF and DKIM checks, and can send you reports about who is sending email using your name.

It's best introduced gently: first just watching, then gradually asking receivers to junk and then refuse fake email, once you're sure your genuine email passes. Our free check flags a watch-only policy as a high risk, because fakes are still delivered. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DKIM: sign your emails

DKIM adds a digital signature to the email you send, so receivers can tell it really came from you and wasn't changed on the way. Your email provider creates the key and you publish it in your DNS, as a TXT record or as CNAME records depending on the provider. You can't make up a DKIM value yourself.

In Google Workspace, DKIM lives in the Google Admin console under Gmail's Authenticate email settings. In Microsoft 365, it's on the DKIM tab of the Email authentication settings in the Microsoft Defender portal (see our Microsoft 365 guide). Newsletter tools and booking systems usually have their own DKIM settings. For a CNAME record (Microsoft 365 uses these for DKIM), use the CNAME section on the same Manage DNS Records page.

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Domains that don't send email

Spare and old domains you never email from can still be used to fake email in your name, so they need locking down too, in a slightly different way from a domain you do use. The full report checks for this and gives the exact records for that domain.

Optional: DNSSEC

DNSSEC adds tamper protection to your DNS records. Our check reports it as a low-priority item. Wix offers DNSSEC only for some domains bought through Wix, as a paid add-on. It isn't available for domains connected by pointing. Whether it applies to your domain depends on your provider and domain ending; the full report tells you.

Check it worked

DNS changes can take up to 48 hours to show everywhere, although they're often quicker. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.

Official Wix help

We checked these steps against the official guides in October 2026. Screens do change, so if something looks different, follow the provider's own guide:

• Adding or updating TXT records in your Wix account
• Managing DNS records in your Wix account
• Activating DNSSEC for a Wix domain

← All DNS guides