MX, SPF, DKIM and DMARC explained
What each DNS record for your email domain does and why mail can fail or land in spam without it.
When you connect a domain, you are asked to add several records. They look technical, but each has one simple job.
MX: where your mail is delivered
An MX record tells the world to deliver mail for your domain to your workspace. Without it, no mail arrives. It has a Priority number. If there is more than one MX, the lowest number is tried first.
SPF: who may send as you
An SPF record is a text (TXT) record that starts with v=spf1. It lists the servers allowed to send mail as your domain. Receivers check it so your mail is less likely to be treated as fake.
Tip: A domain can only have one SPF record. If you already have one, for example from another service that sends mail for you, merge the new part into it instead of adding a second record.
DKIM: a signature on every message
A DKIM record is a TXT record (its name ends in ._domainkey) holding a public key. Your outgoing messages are digitally signed. Receivers use the key to check that a message really came from you and was not changed on the way.
DMARC: what to do when checks fail
A DMARC record is a TXT record named _dmarc. It tells other mail services what to do with mail that claims to be from your domain but fails SPF or DKIM, for example to deliver it, put it in spam, or reject it. It also lets you ask for reports. DMARC is optional, but it is good practice and protects your name from being used by scammers.
Mail app setup records
These optional records let phone and desktop mail apps find your settings automatically, so people can add their account with just an address and password.
How to read the records table
In Admin, Domains, each record shows:
- Type: MX, TXT and so on.
- Name: where to create it.
@means the domain itself. - Value: copy this exactly.
- Priority: used for MX.
- Purpose: what it is for.
If your DNS provider offers a proxy or similar toggle on a record and the page says DNS only, turn the proxy off for that record.
Why this matters
- Without MX, mail is not delivered to you.
- Without SPF and DKIM, mail you send is more likely to be rejected or land in spam.
- Without DMARC, you get no protection or reports about misuse of your domain.
Tips
- Copy values with the copy buttons rather than typing them.
- Do not put quotation marks or extra spaces around a value unless your DNS host adds them itself.
- Add DMARC last, once SPF and DKIM are showing Found.
Common problems
- Two SPF records. Merge them into one.
- DKIM is missing. The Name must be exactly as shown, ending in
._domainkey. - MX points to another provider. Replace the old MX records.