Set up SPF, DKIM and DMARC for your domain

Before you start

• An active hosting or Basic Email service with your domain attached
• If your DNS is hosted elsewhere: access to that DNS provider to add records by hand
• A list of any other services that send mail as your domain, such as a newsletter or invoicing tool

Applies to: Basic Email, Cloud Hosting, WordPress Cloud, Managed WordPress.

Steps

1. Check SPF

   Open Manage DNS in the control panel and look for a TXT record starting v=spf1. New services get v=spf1 include:spf.stackmail.com a mx -all.

   • A domain must have only one SPF record. If another service also sends as your domain, add its include: to the same record instead of creating a second one.

2. Turn on DKIM

   Open DomainKeys, select your domain, enter any selector name you like, and choose Add Signature. If the domain uses FoxFolio Cloud nameservers, the TXT record is added for you.

   • If your DNS is elsewhere, copy the record from the DomainKeys options and add it at your DNS provider.

3. Add DMARC

   Open DMARC Wizard, choose your domain, pick the policy None, and add it. The wizard creates a TXT record named _dmarc.

4. Wait and test

   Allow time for the DNS change to spread, then send a message to an external mailbox and view its headers: SPF, DKIM and DMARC should each show “pass”.

5. Tighten DMARC later

   After a few weeks of clean results from every service that sends as your domain, you can move the policy to quarantine or reject.

Troubleshooting and common mistakes

Two SPF records exist.

Receivers treat two SPF records as an error. Merge them into one record.

DKIM fails for mail sent by a newsletter or billing service.

That service needs its own DKIM record from its provider. The FoxFolio Cloud signature only covers mail sent through FoxFolio Cloud mailboxes.

Legitimate mail is rejected after tightening DMARC.

Return the policy to None, find the sender that is failing, and fix its SPF or DKIM before trying again.

Related guides

• Nameservers and DNS records explainedNameservers say which company answers DNS questions for a domain; FoxFolio Cloud’s are ns1.stackdns.com to ns4.stackdns.com. DNS records are the answers: A and AAAA records point to a server, CNAME points one name at another, MX says where email is delivered and TXT holds text such as SPF, DKIM, DMARC and verification codes. Edit records in the DNS tool of your control panel.
• Connect a domain to email without website hostingWith Basic Email, your domain’s email can use FoxFolio Cloud while the website stays elsewhere. Either point the domain’s nameservers to FoxFolio Cloud and re-create your website records in the control panel, or keep DNS where it is and change only the mail records: the MX record to mx.stackmail.com plus the SPF, DKIM and DMARC TXT records shown in your control panel.
• Fix email that is not sending or receivingFirst test in webmail. If webmail works, the problem is in your mail app: use imap.stackmail.com port 993 and smtp.stackmail.com port 465 or 587 with your full email address as the username. If webmail also fails, check that the mailbox is not full, that the domain’s MX record points to mx.stackmail.com, and that sending limits have not been reached.
• Set up email in Outlook, Apple Mail, Thunderbird or a phoneAdd the account in your mail app with your full email address as the username and your mailbox password. Use IMAP server imap.stackmail.com on port 993 with SSL/TLS, and SMTP server smtp.stackmail.com on port 465 with SSL/TLS (or 587 with STARTTLS), with authentication switched on for outgoing mail. IMAP is recommended so every device sees the same messages.