Learn
Domains & DNS
Which DNS records email depends on, what each one does, and how to set up a sending domain without breaking your website or inbox.
6 min read
Why email lives in DNS
Email has no central registry of who is allowed to send for a domain. Instead, receivers look up public DNS records you control to answer three questions: where should mail for this domain go, which servers may send as it, and can this message's signature be trusted?
Because the answers live in DNS, setting up a sending domain is mostly a matter of adding a handful of records at your DNS provider — Cloudflare, Route 53, GoDaddy or wherever your domain is managed.
The records that matter
Four record types do almost all the work for email:
- MX — lists the servers that receive mail for the domain, each with a priority (lower is tried first). Only needed for receiving.
- TXT — free-form text. SPF policies, DMARC policies and DKIM keys are all published as TXT records.
- CNAME — points one name at another. Email providers often ask you to CNAME a DKIM record to them so they can rotate keys for you.
- A / AAAA — map a name to an IP address. They matter for email mainly through SPF’s "a" mechanism and reverse DNS.
Use a subdomain for sending
Consider sending from a subdomain such as mail.yourapp.com or notifications.yourapp.com rather than your root domain. Reputation is tracked per domain, so a marketing campaign that draws complaints won’t drag down the reputation of the domain you use for password resets or your team’s inbox.
A subdomain also keeps sending records separate from the ones Google Workspace or Microsoft 365 need for your people’s mailboxes, so neither setup can break the other.
MailCraft generates the exact records for each domain you add — you copy them into your DNS provider and we check when they’re live.
Propagation and TTLs
DNS answers are cached for the record's TTL (time to live), commonly 300 to 3,600 seconds. After you add or change a record, some resolvers keep serving the old answer until their cached copy expires — this is what people mean by "propagation".
New records usually appear within minutes. If a check still fails after an hour, the record is most likely on the wrong host name — many DNS panels append your domain automatically, so entering "_dmarc.example.com" can create "_dmarc.example.com.example.com".