Domains, DNS records and mail authentication

Where domains are managed

Workspace administrators open Admin and choose the Domains tab. The Admin page has tabs for Overview, Domains, Users, Groups, API keys, Sending, Mail processing, Security, Single sign-on, Fraud shield, Apps, Vault, Import, Compliance, Data export, Audit log and Plan & limits. Admin and Shield only appear for administrators.

A domain is the part after the @ in your addresses, such as yourcompany.com. You keep owning it where you bought it. You just add a few DNS records there so that mail for it comes to the workspace.

Add a domain

1. Open Admin, then Domains.
2. Type the domain in Add a domain and choose Add domain.
3. The new domain opens with a list of DNS records to create.

Each domain shows a status. Waiting for DNS means the records have not been found yet. Verified means everything checks out. Your plan limits how many domains you can add; the page shows how many you have used.

The DNS records

Add these at the company that runs DNS for your domain (your registrar or a DNS service). The table has a Name, Type, Value and Priority for each, with Copy name and Copy value buttons.

• MX: tells the world to deliver mail for this domain to your workspace. Without it, no mail arrives.
• SPF (a TXT record starting v=spf1): lists the servers allowed to send as your domain, so your mail is not treated as fake. A domain can have only one SPF record, so merge instead of adding a second.
• DKIM (a TXT record at a name ending ._domainkey): a digital signature proving a message really came from you and was not changed on the way.
• DMARC (a TXT record at _dmarc, optional): tells other mail services what to do with mail that fails the checks.
• Mail app setup records are also optional.

If your DNS provider adds the domain name for you, type only the part before it, or @ for the domain itself.

Check DNS

After you save the records at your DNS provider, return to the domain and choose Check DNS. Each record shows whether it was found, and the page shows when it was Last checked. DNS changes can take from minutes to a few hours to spread, so if a record is missing, wait and try again before changing it.

Tip: Fix problems in this order: MX first, then SPF, then DKIM, then DMARC. Mail will arrive after MX, and will be trusted after the other three.

Aliases and catch-all

A domain alias (an Add alias option) is another name for a main domain. Everyone on the main domain also gets mail at the alias and can send from it. It needs its own DNS records.

On a main domain, Catch-all address sets where mail goes when it is sent to an address that does not exist, such as a typo like jhon@ instead of john@. Leave it empty to bounce those messages. Choose Clear to remove it.

Removing a domain

Removing a main domain deletes every mailbox, group and forwarder on it, with their mail. Read the confirmation carefully. Aliases of that domain are affected too.

Checklist for a new domain

1. Add the domain and copy each record.
2. Create MX, SPF, DKIM and, ideally, DMARC at your DNS provider.
3. Run Check DNS until it shows Verified.
4. Create users on the Users tab and test sending to an outside address.
5. Keep a copy of your DNS records in your documentation.