DNS Settings for Email: The Essential Records You Must Configure

DNS Settings for Email: The Records That Keep Messages Flowing

Email delivery depends on a small set of DNS records working together. Misconfigure even one, and your messages land in spam or bounce entirely. Whether you are migrating servers, switching providers, or setting up a domain for the first time, getting these records right is the single most important step you can take.

The Five DNS Records That Matter for Email

Not every DNS record affects email. The ones that do are specific, well-documented, and required or strongly recommended by every major mailbox provider.

MX Records: Telling the World Where to Deliver

The MX (Mail Exchange) record points to the mail server responsible for accepting messages on behalf of your domain. Without a valid MX record, inbound email has nowhere to go. Each MX record includes a priority number; lower numbers indicate higher priority, and multiple MX records provide redundancy.

• Format: domain.com MX 10 mail.yourdomain.com
• Priority: 10 is higher priority than 20
• TTL: 3600 seconds is a standard starting point

SPF: Specifying Who Is Allowed to Send

The SPF (Sender Policy Framework) record lists the IP addresses and hostnames authorized to send email on behalf of your domain. Receiving servers check this record and reject or flag messages that come from unauthorized sources. A missing or overly permissive SPF record damages deliverability.

• Example: v=spf1 ip4:203.0.113.50 include:_spf.google.com ~all
• Mechanisms: ip4, ip6, include, a, mx
• Qualifiers: + (pass), - (fail), ~ (softfail), ? (neutral)

DKIM: Adding a Cryptographic Signature

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing messages. The receiving server fetches a public key from your DNS and uses it to verify the signature. DKIM proves the message was not altered in transit and that it genuinely came from your domain.

• Record name: A selector subdomain, such as selector1._domainkey
• Record type: TXT
• Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhki...

DMARC: Telling Receivers What to Do With Failures

DMARC ties SPF and DKIM together and tells receiving servers how to handle messages that fail authentication. Published as a TXT record at _dmarc.yourdomain.com, it also enables you to receive aggregate and forensic reports about email activity on your domain.

• Example: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com
• Policy options: none, quarantine, reject
• Start with: p=none while you monitor, then tighten

Reverse DNS (PTR): Matching Your Sending IP

Reverse DNS maps your sending IP address back to a hostname. Many spam filters check that the forward DNS (A record for the hostname) and the reverse DNS (PTR record for the IP) match. A mismatched or missing PTR record is a common reason for cold emails landing in spam.

How to Publish and Verify DNS Settings for Email

You add DNS records through your domain registrar or DNS hosting provider. Most providers offer a dashboard where you select the record type, enter the name and value, and set the TTL. After publishing, verification is a distinct step and should not be skipped.

Verification Tools and Steps

• Use MX lookup tools to confirm your MX records resolve correctly
• Run an SPF record checker to validate syntax and look for multiple records
• Use a DKIM validator to confirm the public key is published and parseable
• Check DMARC alignment with an online DMARC analyzer
• Test from a real email address to a Gmail, Outlook, and Yahoo address

Propagation can take minutes to hours depending on TTL values. A record that looks correct in a dig query may not be live yet. Plan changes during low-traffic windows and verify after the TTL window has passed.

Common DNS Settings for Email Mistakes

The most frequent errors fall into a few predictable categories. Avoiding them saves the frustration of troubleshooting bounces and spam folder placements.

• Multiple SPF records: A domain must have exactly one SPF TXT record. Multiple records cause a permanent permerror.
• SPF too broad: Using include:all or ip4:0.0.0.0/0 authorizes every server, which removes any protection.
• Missing MX fallback: A single MX record with no backup creates a single point of failure.
• DKIM selector mismatch: The selector in the email header must match the subdomain used in the DNS record.
• Ignoring DMARC: Without a DMARC record, you have no visibility into who is sending on your behalf.

DNS Settings for Email When Using Third-Party Senders

If you use a marketing platform, a customer support tool, or a shared workspace, those services send email on your domain's behalf. Each service requires an entry in your SPF record via the include mechanism, and many require a dedicated DKIM key published in your DNS.

Before adding a third-party sender, obtain the specific DNS values from that provider's documentation. Add them to your SPF record and DKIM key, then send a test message and check the authentication headers. Most platforms provide a step-by-step setup wizard that lists exactly which records to add and where.

A Practical Checklist Before Going Live

Use this checklist to confirm your DNS settings for email are complete before you announce a new address or migrate traffic.

Once all records pass verification and test messages land in inboxes consistently, your DNS settings for email are ready for production traffic. Monitor DMARC reports periodically to catch unauthorized senders and adjust your records as your infrastructure evolves.