Documentation · DNS and deliverabilityEvery DNS record has one job.
Publish the complete set. A domain is healthy only when identity, signing, inbound routing, and return-path checks agree.
7 min readUpdated Jul 22, 2026v1.0
Prove and sign
Ownership TXT and three DKIM CNAME records prove control and sign outgoing messages.
Route mail
The inbound MX receives mail. Custom MAIL FROM uses its own MX and SPF TXT for the return path.
Set policy
SPF describes permitted senders and DMARC tells receiving systems how to handle failed authentication.
