Skip to main content
Authenticating your domain proves your mail is genuinely yours, which is what gets campaigns past spam filtering and into the inbox. It’s a one-time DNS setup per domain.

​
Setup flow

1

Add your domain

Register the domain you’ll send from in domain settings.
2

Get the DNS records

The setup shows the exact records to add. See DNS Records for what each one is.
3

Add them at your DNS provider

Enter them manually, or use the automatic option if your DNS provider is connected, which adds them for you.
4

Verify

Re-check after the records propagate. Verification passes once the required records resolve.

​
What gets checked

A complete setup has these records:
  • DKIM. Three CNAME records that let outgoing mail be cryptographically signed. These are what make the domain send-ready.
  • Mail-from. An MX record and an SPF (TXT) record on a bounce subdomain, so bounces are handled on your domain and SPF aligns for DMARC.
  • DMARC. A TXT record telling receivers what to do with mail that fails the checks.
The domain becomes send-ready once the three DKIM records verify. The mail-from and DMARC records aren’t required to send, but add them for the best deliverability.

​
Handling conflicts

The setup inspects your existing DNS and tells you exactly what to change rather than leaving you to guess:
  • A DKIM host already in use. If a previous email provider left a CNAME at the selector, edit it to the value shown. An old TXT key at the same name should be deleted first.
  • An existing mail-from record. If the bounce subdomain already carries an MX or TXT record, the setup names exactly what to change.
  • An existing DMARC record. Left as-is. You don’t need a second one.
You’ll also see advisories for weak existing policies, like a DMARC at p=none.

​
Troubleshooting

  • Add records to the correct host. A domain accidentally doubled onto the host is the most common mistake.
  • Watch for stray quotes or characters copied around a value.
  • Give DNS time to propagate before re-checking.
  • Confirm all three DKIM records resolve. Two of three is not send-ready.