Skip to content
emailservicesolutions

DNS records explained

Mailbox providers decide how much to trust a message partly by looking up DNS records for the domain and the sending IP. These are the ones that matter.

SPF

Lists which servers may send mail for your domain. It is a single TXT record at the domain's root starting with v=spf1.

  • Publish exactly one SPF record. Two records make SPF fail.
  • SPF allows at most 10 DNS lookups in total (each include, a, mx and similar counts). More than that fails.
  • End with -all or ~all. Avoid +all and ?all, which accept anything.
example.com.  TXT  "v=spf1 ip4:203.0.113.25 -all"

DKIM

Signs each message with a private key; receivers check the signature using a public key you publish at <selector>._domainkey.<domain>.

  • Use 2048-bit RSA keys. 1024-bit keys are weak.
  • Rotate keys by publishing a new selector, switching signing, then retiring the old one later.
  • We generate keys on our side and show you only the public record.

DMARC

Tells receivers what to do when SPF and DKIM don't align with the visible From domain, and where to send reports. Published as a TXT record at _dmarc.<domain>.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:reports@example.com"

Start with p=none and read the reports. Move to quarantine and then reject when everything legitimate passes.

MX and A records

MX records say where mail for a domain is delivered. A sending-only domain can publish a null MX (0 .) so nothing is delivered to it. The host name your server announces should have an A record pointing at the server.

Reverse DNS (PTR)

The server's IP address should resolve back to a host name, and that name should resolve forward to the same IP. Your server provider sets the PTR record. Set the server's greeting name to match.

MTA-STS and TLS-RPT

MTA-STS tells other servers to deliver to you only over verified TLS. It needs a TXT record at _mta-sts.<domain> and a small policy file served over HTTPS. TLS-RPT (_smtp._tls.<domain>) asks for reports about TLS failures. Both are optional and worth adding once the basics are solid.

BIMI

Optionally shows your logo next to messages in some mailboxes. It requires a strict DMARC policy first.

Checking your work

The free DNS check reads these records and explains anything that is missing or wrong, with the exact record to publish.