VayloMailSee pricingWhat each record does
| Record | Where it goes | What it does |
|---|---|---|
| MX | Your domain, for example example.com | Names the host that receives mail for the domain. |
| SPF (TXT) | Your domain, for example example.com | Lists the servers allowed to send mail for the domain. RFC 7208. |
| DKIM (TXT) | selector._domainkey.<your domain> | Publishes the public key that checks the DKIM-Signature on each message. RFC 6376. |
| DMARC (TXT) | _dmarc.<your domain> | Says what receivers should do with mail that fails the domain's checks, and where to send reports. RFC 7489, obsoleted by RFC 9989. |
| Reverse DNS (PTR) | The reverse zone for the server's IP address, not your domain's zone | Maps the IP address back to a host name. RFC 1035. VayloMail sets this for your dedicated IP. |
Example values for example.com
These values are examples only. Replace them with the values your server gives you. The DKIM key is shortened and is not a real key.
| Record | Example |
|---|---|
| MX | example.com. 3600 IN MX 10 mail.example.com. |
| SPF | example.com. 3600 IN TXT "v=spf1 mx ~all" |
| DKIM | s1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=<base64 public key>" |
| DMARC | _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com" |
| Reverse DNS | 10.113.0.203.in-addr.arpa. IN PTR mail.example.com. for the example IP address 203.0.113.10 |
In the SPF example, mx authorises the hosts named in the domain's MX records, and ~all is a soft fail for every other sender. The selector s1 is a placeholder. The selector your server uses is set during setup.
Common mistakes
- Two SPF records. A domain must not publish more than one record that starts with v=spf1. When a receiver finds two, the SPF check returns a permerror, so combine the mechanisms into one record (RFC 7208, sections 3.2 and 4.5).
- More than 10 DNS lookups in SPF. The include, a, mx, ptr and exists mechanisms, and the redirect modifier, count toward a limit of 10 lookups during evaluation. Going over returns a permerror (RFC 7208, section 4.6.4).
- DMARC p=reject too early. p=reject tells receivers to reject mail that fails. Start with p=none, add a rua address, read the reports, and fix the senders that fail. Move to quarantine or reject once your legitimate mail passes (RFC 7489, section 6.3; obsoleted by RFC 9989).
- A DKIM selector that does not match. Receivers look up the key at the selector named in the DKIM-Signature header. If the record is missing or sits under a different selector, the signature cannot be checked (RFC 6376, section 3.6.2.1).
- Changing nameservers without a plan. A nameserver change moves authority for the whole DNS zone, including website records. Copy the existing records first.
- Reverse DNS that does not match. The PTR name should resolve back to the same IP address. Many receivers check this.
How to check them
Look up each record with a DNS lookup tool and compare the answers with the examples and rules above. DKIM records are found by selector, so you need the selector your server uses. Use the email DNS check to look up a domain's records and compare them with this guide. DNS changes can take time to spread, so an old answer can remain for a while after a change.
What VayloMail sets up
VayloMail publishes SPF, DKIM and DMARC records, and configures TLS and reverse DNS for your dedicated IP. Standard onboarding uses the VayloMail nameservers, ns1.vaylomail.com and ns2.vaylomail.com, once the server is ready. When your domain points at them, these records are set for you.
Changing nameservers gives VayloMail authority over the whole DNS zone, including website records. If your domain already has a website or another mail service, ask support to agree the DNS plan before you change anything.
Standards cited
- RFC 1035, Domain Names: Implementation and Specification (PTR records and IN-ADDR.ARPA lookups).
- RFC 6376, DomainKeys Identified Mail (DKIM) Signatures.
- RFC 7208, Sender Policy Framework (SPF).
- RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC). Obsoleted by RFC 9989, which covers DMARC under the same title.
Questions, answered
Which DNS records does a new mail server need?
An MX record so mail for your domain is delivered to the server, and SPF, DKIM and DMARC records so receivers can check mail from your domain. Reverse DNS is set on the server's IP address, not in your domain's zone. VayloMail publishes SPF, DKIM and DMARC and configures reverse DNS when the domain uses its nameservers.
Can I have two SPF records if I use two sending services?
No. A domain must publish one SPF record that starts with v=spf1. List every service that sends for the domain in that one record, and keep the number of DNS lookups within the limit of 10.
Should I start DMARC at p=reject?
No. Start with p=none, which asks receivers to take no specific action, and add a rua address to receive reports. Move to quarantine or reject when the reports show that your legitimate mail passes DMARC. DMARC is specified in RFC 7489, which RFC 9989 obsoletes.
Does VayloMail set these records up for me?
Yes, when your domain uses the VayloMail nameservers, ns1.vaylomail.com and ns2.vaylomail.com. VayloMail publishes SPF, DKIM and DMARC records and configures reverse DNS for your dedicated IP. Check the published records with the email DNS check on this site.