DNS records explained: MX, SPF, DKIM and DMARC
What each mail DNS record does, and what a healthy set looks like.
MX: where your mail is delivered
The MX record tells the internet which server receives mail for your domain. A lower priority number is tried first.
SPF: who may send for you
An SPF TXT record lists the servers allowed to send mail as your domain. Receivers use it to spot forged mail.
DKIM: a signature on each message
A DKIM record publishes the public key that proves a message was signed by your platform and not changed on the way. The selector in these records is mail.
DMARC: what to do when checks fail
A DMARC record at _dmarc.yourdomain tells receivers to none (only report), quarantine or reject mail that fails SPF and DKIM. Start with monitoring and tighten it once the reports look clean.
Example records for acme.com
| Type and name | Value | Purpose |
|---|---|---|
| MX acme.com (10) | mail.arabianmail.com | Receive mail |
| TXT acme.com | v=spf1 mx include:spf.arabianmail.com -all | Authorised senders |
| TXT mail._domainkey.acme.com | v=DKIM1; k=rsa; p=… | Message signature |
| TXT _dmarc.acme.com | v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.com | Policy and reports |
If something goes wrong
How long do DNS changes take?
From a few minutes to a few hours, depending on the TTL of the old record.
Related guides
Still need help?
Tell us what you were trying to do and what you saw on screen. We will help you finish it.