Domains & DNS
Two records to a verified domain — or none with Cloudflare.
Mail must sign as a domain you control. Add yours in the dashboard and publish the records it shows; verification runs automatically.
| Record | Why |
|---|---|
| DKIM | The verification itself — it proves the domain is yours and signs every message. |
| DMARC | Recommended: tells mailbox providers what to do with unsigned mail. p=none is a safe start. |
| Bounce CNAME | New domains only: a branded return path, so delivery reports go to a hostname on your domain. |
Cloudflare
If your domain's nameservers are Cloudflare, the Connect Cloudflare button writes every record for you with scoped DNS permission — no copy-paste, no missed record.
When your DNS panel truncates the DKIM record
A DKIM record for a 2048-bit key runs past 255 characters, and 255 is the most a single DNS text string can hold. Most DNS panels handle that by splitting the value into quoted parts; some silently cut it off at 255 instead. A cut key verifies nowhere — every signature fails — so the dashboard flags the record and says the value looks truncated.
- Ask your provider to publish the full value — the split form is one record whose value is written as two quoted strings: "first 255 characters" "the rest", which resolvers join without a space.
- On cPanel/WHM hosting, use the DNS Zone Editor rather than a simple record form: it accepts the full value and splits it correctly on save.
- Or move the domain's DNS to a provider that handles long records — Cloudflare is free, and the Connect Cloudflare button then writes every record for you.
Split the value yourself only if your panel leaves no better option: the two parts must sit in the same record, each in double quotes, with a space between them. Two separate TXT records with the same name do not verify.
Review
New sending domains are reviewed by hand before the first send. Everyone sends through the same infrastructure, so one domain's reputation is everyone's — the review is what keeps the shared delivery rate high. You can publish DNS while the review runs.
Checking and re-checking
Verification is polled every few minutes, and the Re-check button asks immediately. The domain shows Verified once the records are live and the review has passed.
Outside the dashboard, the free email authentication checker reads any domain's public DNS the way receivers do — MX, SPF, DKIM and DMARC — and reports what each record says.