Email DNS records: MX, SPF, DKIM and DMARC

Substitute your own mail hostname for mail.example.com; the panel shows the exact strings for your server under the domain’s mail settings, so you copy values rather than compose them.

Both are chosen so that turning mail on cannot cost you your mail on the first day, and both are yours to tighten once you can see that nothing else is sending as you.

~all is a soft fail rather than -all. A domain whose mail is entirely here can be tightened to -all. A customer who also sends through a newsletter service would find their mail started being rejected by a record the panel had written for them, which is not a thing a panel should do on somebody’s behalf.

p=none is monitoring only. Asking receivers to reject on a policy nobody has yet observed working is how a domain loses its own mail on day one. Watch, then move to p=quarantine and later p=reject if you want them.

The DKIM record is offered only once the server has a key to sign with. Publishing a key that nothing signs with would make every message fail verification rather than simply not be signed, which is worse than having no DKIM at all.

When Dashmox is the authoritative DNS for the domain, it publishes the MX, SPF and DMARC records itself when you turn on mail for that domain, and signs outgoing mail with DKIM. There is nothing to copy out and paste in.

When your DNS is somewhere else, at your registrar or another provider, Dashmox shows you the exact email DNS records to add there, and you add them by hand. The panel shows them under the domain's mail settings, so you are copying values rather than composing them.

• Add every one of them, not just MX. Mail arrives with MX alone, but what you send will be treated as suspect.
• Wait for the old values to expire before judging the result, because receivers cache what they last saw.
• Send a test message to an address on a large mail provider and look at whether it arrives in the inbox or the spam folder.

Check what is actually published, from somewhere other than the server:

dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT dashmox._domainkey.example.com

An empty answer means the record is not there, or has not propagated yet. A doubled SPF line means you have two, which counts as none.

Mailboxes live under Mail, with a size limit each and forwarding if you want it. Mail is read over IMAP on port 993 and sent over SMTP on port 465, both over TLS, and there is Roundcube webmail in the browser for anyone who would rather not set up a client at all.

Dashmox answers the automatic configuration that Thunderbird and Outlook look for, so in most mail clients the address and password are enough and the ports fill themselves in. An account can only send as its own address, and sending is rate limited, which is what stops one compromised password turning your domain into a spam source.

Mail is stored outside the website's own account, so a compromised website does not give somebody your mail.