Email DNS records: MX, SPF, DKIM and DMARC

Four DNS records connect your domain to FiniteHost email. MX tells the world where to deliver your mail. SPF, DKIM and DMARC prove that mail sent from your domain really comes from you, which keeps it out of spam folders. This guide explains each record, shows how to add them at the common registrars, and how to check that they work.

Before you start#

• Create at least one mailbox on the domain first (Email accounts). The DKIM key is generated for your domain when its first mailbox is set up.
• Know where your domain's DNS is managed. Usually that is the registrar where you bought the domain (BigRock, GoDaddy, Hostinger and so on). If you moved your nameservers to Cloudflare, add the records at Cloudflare instead.
• Open the panel in another tab on Email → Email accounts (the Mail DNS for … card) or, on web plans, Domains & DNS. Every value has a copy button. Copy, never retype.

The four records#

For the demo domain acme.in, the panel shows:

What each record does#

• MX (mail exchanger). "Mail for acme.in goes to mx1.finitehost.com." Without it, no mail reaches your mailboxes. The 10 is the priority; with one MX record it does not matter, but most DNS panels ask for it in a separate Priority box.
• SPF (Sender Policy Framework). A TXT record that lists the servers allowed to send mail as @acme.in. include:_spf.finitehost.com allows the FiniteHost mail server; -all says "reject everything else".
• DKIM (DomainKeys Identified Mail). The FiniteHost server signs every message you send with a private key. This TXT record publishes the matching public key under the name fh1._domainkey, so receivers can check that the message was not changed and really came from your domain.
• DMARC. Tells receivers what to do when a message claims to be from acme.in but fails SPF and DKIM. p=quarantine means "put it in spam". This protects your customers from people who forge your address.

Name or host: full name or short name?#

DNS panels differ in what they want in the Name (or Host) box:

@ means "the domain itself". If you type the full form into a panel that adds the domain automatically, you get fh1._domainkey.acme.in.acme.in, which does not work. After saving, look at how the panel displays the record; if your domain appears twice, edit it to the short form.

Add the records: general steps#

These steps are the same everywhere; only the menu names differ.

1. Sign in to your registrar or DNS provider and open the domain's DNS (also called DNS Management, Manage DNS or DNS zone).
2. Remove old MX records that point to another provider. Keep only one MX record, the FiniteHost one.
3. Add the MX record: Type MX, Name @, Value or Mail server mx1.finitehost.com, Priority 10. Some panels want a trailing dot: mx1.finitehost.com. is the same thing.
4. Add or edit the SPF record: Type TXT, Name @, Value v=spf1 include:_spf.finitehost.com -all. If a TXT record starting with v=spf1 already exists, edit that one instead of adding a second (see the note below).
5. Add the DKIM record: Type TXT, Name fh1._domainkey, Value: paste the whole DKIM value from the panel.
6. Add the DMARC record: Type TXT, Name _dmarc, Value v=DMARC1; p=quarantine. If a _dmarc record already exists, replace its value.
7. Leave TTL at its default (often 1 hour, or "Auto").
8. Save. Changes usually show up within minutes to an hour, and occasionally take up to 24 hours.

BigRock#

1. Sign in to BigRock and open Domains → your domain → Manage.
2. Open DNS Management (it may ask you to activate the DNS service once).
3. Use the MX Records tab for the MX record: Zone/Host left empty or @, Value mx1.finitehost.com, Priority 10. Delete other MX entries.
4. Use the TXT Records tab three times: SPF with Host empty or @, DKIM with Host fh1._domainkey, DMARC with Host _dmarc.

GoDaddy#

1. Sign in, open My Products → your domain → DNS (or Manage DNS).
2. Click Add New Record. Choose MX, Name @, Value mx1.finitehost.com, Priority 10. Delete GoDaddy's own MX records if present.
3. Add three TXT records: Name @ (SPF), Name fh1._domainkey (DKIM), Name _dmarc (DMARC).
4. If GoDaddy already shows a _dmarc record, edit it rather than adding a second.

Hostinger#

1. Open hPanel → Domains → your domain → DNS / Nameservers (DNS records).
2. Delete existing MX records that point to Hostinger mail.
3. Add an MX record: Name @, Points to mx1.finitehost.com, Priority 10.
4. Add three TXT records with Names @, fh1._domainkey and _dmarc. If an SPF record for Hostinger mail exists, replace its value with the FiniteHost one (unless you still send through Hostinger, in which case merge).

Cloudflare#

1. Open your domain in the Cloudflare dashboard → DNS → Records.
2. Add record → Type MX, Name @, Mail server mx1.finitehost.com, Priority 10.
3. Add three TXT records: Name @ (SPF), fh1._domainkey (DKIM), _dmarc (DMARC). Paste the DKIM value in one piece; Cloudflare stores long values correctly.
4. MX and TXT records cannot be proxied, so there is no orange cloud to switch off for them.

Check the records#

From the command line#

On Windows, open Command Prompt; on Mac or Linux, open Terminal. Replace acme.in with your domain.

nslookup -type=mx acme.in
nslookup -type=txt acme.in
nslookup -type=txt fh1._domainkey.acme.in
nslookup -type=txt _dmarc.acme.in

On Mac and Linux dig gives shorter answers:

dig +short MX acme.in
dig +short TXT acme.in
dig +short TXT fh1._domainkey.acme.in
dig +short TXT _dmarc.acme.in

What you should see:

To ask a specific public resolver and skip your computer's cache, add it at the end: nslookup -type=mx acme.in 1.1.1.1.

With a test message#

1. Send a short message from your FiniteHost mailbox to a Gmail address you own.
2. In Gmail, open it, click the three-dot menu → Show original.
3. At the top, Gmail lists SPF, DKIM and DMARC. All three should say PASS, and DKIM should mention acme.in.

More ways to check, including a full header analysis: Keep your mail out of spam.

Troubleshooting#

See also Check your DNS for general DNS checks.

What's next#

• Mail app settings
• Keep your mail out of spam
• Email troubleshooting