Ghost CMS Newsletter Email Delivery and SPF Authentication

Ghost CMS newsletters rely heavily on third-party email service providers (ESPs) like Mailgun or Postmark to reliably deliver emails to your subscribers' inboxes. Without proper DNS authentication, your newsletters will likely land in the spam folder or be rejected outright by major mailbox providers. Setting up Sender Policy Framework (SPF) tells receiving mail servers which IP addresses are authorized to send mail on behalf of your domain.

To ensure your domain is properly configured, you can use the SPF Checker to instantly verify your DNS records and catch syntax errors before your next broadcast. This tool helps you validate your exact record structure and check for common lookup limit issues.

Understanding Ghost CMS Newsletter Architecture and Email Sending

Unlike traditional self-hosted WordPress sites that might use a local PHP mail function, Ghost isolates its application layer and delegates email delivery to transactional email APIs. When you publish a newsletter, Ghost formats the content and pushes it via API to your configured mail provider.

Your mail provider then dispatches the email using their own mail transfer agents (MTAs), but uses your custom domain in the From and Return-Path headers. Because the physical sending IP belongs to Mailgun, Postmark, or SendGrid rather than your own web server, mailbox providers check your domain's DNS to see if that ESP is explicitly allowed to send your mail. This is where SPF comes into play.

Core Requirements Before You Begin

Before you start updating your DNS records, make sure you have the following pieces in place:

• Access to your DNS provider: Administrative access to Cloudflare, AWS Route 53, GoDaddy, or wherever your domain's nameservers are hosted.
• An active ESP account: Your Mailgun, Postmark, or Mailjet dashboard open, where your specific DNS records are displayed.
• A custom domain: You cannot set up custom SPF records for default subdomains like yourblog.ghost.io. You must use a custom domain such as example.com.

Step-by-Step SPF Setup for Ghost CMS

Configuring your SPF record involves adding a TXT record to your DNS zone. If you already have an SPF record, you must update it rather than creating a second one, because a domain with multiple SPF records fails validation.

Step 1: Gather Your ESP's SPF Inclusion String

Log into your mail provider's dashboard and navigate to the domain verification or sending settings section. Look for the required TXT records. For example, Mailgun typically requires an include statement like include:mailgun.org, while Postmark requires include:spf.mtasend.com.

Step 2: Check for Existing SPF Records

Query your domain using your terminal to see if an SPF record already exists. Run the following command:

nslookup -type=TXT example.com

Or using dig on Linux and macOS:

dig TXT example.com

Sample output:

;; ANSWER SECTION:
example.com.        300     IN      TXT     "v=spf1 include:mailgun.org ~all"

Step 3: Add or Update Your DNS TXT Record

Log into your DNS management console. Create a new TXT record or edit your existing one using the following parameters:

• Type: TXT
• Host / Name: @ (or leave blank for root domain, depending on your provider)
• Value / Content: v=spf1 include:mailgun.org ~all (replace include:mailgun.org with your specific ESP include statement)
• TTL: Auto or 300 seconds

If you send mail from multiple services (for example, Google Workspace for corporate email and Mailgun for your Ghost newsletter), you must combine them into a single record:

v=spf1 include:_spf.google.com include:mailgun.org ~all

Comparison of Common SPF Mechanisms and Qualifiers

Verifying Your Setup with Commands and Tools

After saving your DNS changes, remember that global DNS propagation can take anywhere from a few minutes to a couple of hours. You can test your live DNS configuration using command-line tools or PowerShell.

To check your DNS propagation via PowerShell on Windows, run:

Resolve-DnsName -Name example.com -Type TXT

To verify that your mail provider recognizes the setup, send a test newsletter from your Ghost admin panel to an external testing address like Mail-tester.com. Review the resulting report to ensure your SPF signature passes authentication alongside DKIM and DMARC.

Common Mistakes and How to Fix Them

Even experienced administrators occasionally run into syntax or configuration traps when setting up email authentication for newsletters.

• Multiple SPF Records: Creating two separate TXT records starting with v=spf1 causes an immediate neutral or fail result. Always merge all required includes into a single TXT record.
• Exceeding the 10-DNS-Lookup Limit: SPF specifications limit DNS lookups to a maximum of 10. If you nest too many include statements (e.g., including services that themselves include other services), your SPF evaluation breaks. Audit your record and replace nested includes with static ip4 or ip6 blocks where necessary.
• Typo in the Include Statement: A simple typo like incude:mailgun.org instead of include:mailgun.org invalidates the rule, allowing unauthorized servers through or failing legitimate mail.
• Forgetting DKIM and DMARC: SPF is only one leg of the stool. Ghost newsletters also require DKIM (DomainKeys Identified Mail) CNAME or TXT records and a DMARC policy record to achieve high deliverability.

Quick Checklist for Ghost Newsletter Email Authentication

1. Logged into your ESP and retrieved the exact SPF include string.
2. Checked your current DNS zone for any existing SPF TXT records.
3. Created or updated a single TXT record at the root domain (example.com).
4. Combined multiple sending sources (like Google Workspace and Mailgun) into one string.
5. Verified the record using an online checker or command-line query.
6. Sent a test broadcast from Ghost to confirm inbox placement.