DNS and authentication

How to Set Up DNS Records (MX, SPF, DKIM, DMARC)

EmailPal writes MX, SPF, dual DKIM and DMARC p=reject for you, then re-verifies them on public resolvers. This page is the full setup guide: what each record does, what we publish, BYO copy-paste rules, and how to debug a red check.

SPF, DKIM, DMARC and MX

What EmailPal writes for SPF, dual DKIM, DMARC p=reject and MX, why we re-verify against public resolvers, and what to do when a check fails. This is the primer; the setup walkthrough is the Instantly-titled DNS article.

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists which servers may send email for your domain. EmailPal publishes a hard-fail SPF that includes our sending hosts, then re-verifies it publicly.

What is DKIM?

DKIM (DomainKeys Identified Mail) is a cryptographic signature on each message. EmailPal publishes two keys per domain — RSA-2048 and Ed25519 — and signs outbound mail with them.

What is DMARC?

DMARC tells receivers what to do when SPF or DKIM fail, and whether the From domain aligns. EmailPal sets p=reject on sending domains so unauthenticated mail claiming to be you is not delivered.

DNS verification failed

What a failed SPF, DKIM, DMARC or MX check means, why we query public resolvers, and how to fix BYO domains.

DKIM not validating

DKIM fails when a selector TXT is missing, truncated, still propagating, or looking up against the wrong nameserver. EmailPal publishes rsa._domainkey and ed._domainkey and re-checks both on public resolvers.

Why DMARC is p=reject

EmailPal sets DMARC p=reject on sending domains so unauthenticated mail is refused. Why we do not offer p=none for hosted sending.