Configure Email DNS Records
Publish and verify the DKIM, SPF, MX, and DMARC records shown by your EmitMail server.
Email authentication records help receiving mail systems evaluate messages, but they do not guarantee inbox placement. Add the values shown in your EmitMail dashboard's DNS checklist. Hostnames and values depend on your server configuration, and DNS providers use different conventions for the record name field.
Add the records
Add your sending domain in the dashboard to generate a DKIM key and view the DNS records required by your server configuration. Publish each record with your DNS provider, then use the dashboard's DNS verification action to check them.
| Type | Name / host | Value / target | Purpose |
|---|---|---|---|
TXT | Selector shown in dashboard + ._domainkey | DKIM value shown in dashboard | Publishes the public key used to verify signatures |
TXT | Return-path host shown in dashboard | SPF value shown in dashboard | Authorizes the configured sending infrastructure |
MX | Return-path host shown in dashboard | Mail host shown in dashboard | Routes mail sent to the return-path host |
TXT | _dmarc | DMARC policy for your domain | Tells receivers how to handle mail that fails authentication alignment |
Follow the exact hostnames and values displayed by your EmitMail instance. Some DNS providers automatically append your domain to the name field; avoid accidentally creating a duplicated domain suffix. Publish only one SPF record at each hostname. If one already exists, merge the required authorization into that record instead of creating a second SPF record.
DKIM, SPF, and MX
- In the dashboard, add your sending domain. EmitMail generates a DKIM key and displays its selector and TXT value. Keep the private key and server secrets private.
- Add the DKIM TXT record using the selector hostname and full value shown in the dashboard. If your DNS provider offers proxying, set this record to DNS-only.
- Add the SPF and MX records using the return-path hostname and values in the dashboard. Confirm the mail hostname resolves to the correct public server address.
- If you use a proxy/CDN DNS provider, mail host A/AAAA and MX targets must resolve directly to the mail server; an HTTP proxy does not proxy SMTP.
DMARC rollout
Start with a monitoring policy such as p=none and configure a working aggregate report address. Review reports and confirm legitimate mail passes SPF or DKIM alignment before moving to p=quarantine or p=reject. For example:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comUse an address that exists and can receive reports. Apply a stricter policy only after you understand all legitimate services sending mail for the domain; otherwise, receivers may reject valid messages.
Verify DNS
Click the domain's DNS verification action in the dashboard. The current verifier checks DKIM, SPF, and MX; DMARC is reported separately and is not required for the domain to pass the required checks. DNS changes may take time to appear in public resolvers, so recheck after your provider publishes them. A successful DNS check does not guarantee delivery or inbox placement.