How to set up MX, SPF, DKIM and DMARC when your DNS is elsewhere

Introduction

Your domain’s DNS is a list of records that tells the internet where to find your website and where to deliver your email. The company that holds this list is your DNS provider.

If your domain uses our nameservers (the servers that tell the internet where your domain’s DNS lives), we create every mail record for you. You can skip this guide.

If your DNS is somewhere else, such as Cloudflare, Namecheap or the company you bought the domain from, we cannot add records there. You need to add them yourself. This guide gives you the exact records to add.

The Four Mail Records

You will add four kinds of record:

• MX, which tells other mail servers where to deliver email for your domain.
• SPF, a list of the servers that are allowed to send email for your domain.
• DKIM, a signature that proves an email really came from you.
• DMARC, a rule that tells receivers what to do with email that fails the SPF or DKIM checks.

If you want to know more about why Gmail needs these, see the guide to email rejected by Gmail.

Before You Start

You need the IP address of your hosting. An IP address is the number that identifies a server on the internet. Ours is shown for your site in the panel, and it is currently:

51.159.215.207

Next, open your DNS provider and look for mail records left by a previous email host.

Note: Old MX records and a second SPF record are the most common reasons email fails after a move. Delete them before you add the new ones.

Adding the MX Record

The MX record needs a helper record first. The helper is an A record, which links a name to an IP address. Here it links mail.yourdomain.com to our server.

1. At your DNS provider, add an A record:

Type:  A
Name:  mail
Value: 51.159.215.207

2. Add the MX record. The name @ means the root of your domain, which is yourdomain.com itself:

Type:     MX
Name:     @
Value:    mail.yourdomain.com
Priority: 10

3. Delete any other MX records on the domain.

Your provider may ask for a priority. The priority only matters when you have more than one MX record, so 10 is fine.

Note: On Cloudflare, the mail A record must stay on DNS only (grey cloud). If it is proxied (orange cloud), email stops working. The Cloudflare guide lists every mail record that must stay grey.

Adding the SPF Record

SPF is one TXT record on the root of your domain. A TXT record is a record that holds plain text.

1. Add this record:

Type:  TXT
Name:  @
Value: v=spf1 a mx ~all

This record says that the servers your website and MX records point to are allowed to send your email.

If your website goes through Cloudflare’s proxy, the a part points at Cloudflare instead of at us. The mx part is then what lets SPF pass. This is one more reason to keep the MX record correct.

Note: A domain must have only one TXT record that starts with v=spf1. If you also send email through another service, such as a newsletter tool, merge both into one record. That service’s help pages tell you which part to add.

Adding the DKIM Record

DKIM works with two keys. We keep a private key and sign every email you send with it. You publish the matching public key in your DNS, so receivers can check the signature.

The public key goes in a TXT record with this name:

hostingcp._domainkey

hostingcp is the selector, which is just the label we use for the key. Some providers want the full name instead, hostingcp._domainkey.yourdomain.com. Use the same style as your other records.

The value is a long piece of text that starts with v=DKIM1. It is different for every domain, so you need to copy yours from the panel.

1. Log in to the panel and open your website.
2. Find the email authentication settings for your domain.
3. Copy the DKIM value in full.
4. At your DNS provider, add the record:

Type:  TXT
Name:  hostingcp._domainkey
Value: (the value you copied, starting with v=DKIM1)

If you cannot find the value, open a ticket at client.getlitehost.com/support. We will turn signing on for your domain and send you the exact value.

Note: If DKIM signing is turned off and on again for your domain, a new key is created. The old record then stops matching. Copy the new value to your DNS provider whenever this happens.

Some providers split long values or add quotation marks for you. Paste the value as one piece and let the provider handle it.

Adding the DMARC Record

Start DMARC in monitoring mode. In this mode it reports problems but does not block any email.

1. Add this record:

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none

After your email has been passing the checks for a few weeks, you can change p=none to p=quarantine. The Gmail guide explains what each setting does.

Checking Your Records

DNS changes can take up to an hour to be seen everywhere.

1. After an hour, run these commands on any computer with a terminal:

dig +short MX yourdomain.com
dig +short TXT yourdomain.com
dig +short TXT hostingcp._domainkey.yourdomain.com
dig +short TXT _dmarc.yourdomain.com

2. Each command should print the value you added.
3. Send an email from your domain to a Gmail address and open it.
4. Click the three dots, then Show original. SPF, DKIM and DMARC should all say PASS.

Troubleshooting

• No email arrives at all. Check the MX record first. It must point at mail.yourdomain.com, and that name must point at 51.159.215.207.
• SPF fails. Look for a second v=spf1 record, or a mail record that is proxied on Cloudflare.
• DKIM fails. The value was cut short when you pasted it, or the key changed after you copied it. Copy it again from the panel.
• Your mail app cannot connect. See the email setup guide.

If all four records look right and email still fails, open a ticket at client.getlitehost.com/support. Include your domain name and the output of the dig commands.