DNS Records - Onchain Suite Docs

Authenticating a sending domain adds a handful of records. The setup flow shows the exact values for your domain; this page explains what each one is for.

Record	Type	Host	Purpose
DKIM (three)	CNAME	`<token>._domainkey`	Let outgoing mail carry a cryptographic signature.
Mail-from MX	MX	`bounce` subdomain	Route bounce and complaint reports on your domain.
Mail-from SPF	TXT	`bounce` subdomain	Align SPF so DMARC passes.
DMARC	TXT	`_dmarc`	Tell receiving providers how to treat mail that fails the checks.

DKIM is three CNAME records, not a TXT record. All three must resolve for the domain to be send-ready. Add them exactly as shown.

Adding them

Enter each record in your DNS provider’s zone for the domain, or use the automatic option if your provider is connected. Verification checks the records and passes once the three DKIM CNAMEs resolve.

If you already send email

You may already have a DMARC record, or a leftover DKIM selector from a previous provider. Don’t stack a second one:

DKIM. If a CNAME already sits at one of the selector hosts, edit it to the new value rather than adding a duplicate.
DMARC. Keep your existing policy; you don’t need another record.

The setup detects these and tells you whether to add or edit, so follow what it shows rather than pasting blindly.

Tips

Copy each value exactly, with no added quotes or trailing characters.
Make changes in the correct DNS zone.
Allow propagation time (minutes to an hour, sometimes longer) before re-checking.
A weak existing DMARC (p=none) still verifies, but the setup flags it so you can tighten it.