DNS and authentication

How to Set Up DNS Records (MX, SPF, DKIM, DMARC)

Q: Can I set these up on a free Gmail address?

No. SPF/DKIM/DMARC are domain records. gmail.com is Google's domain. Use a domain you control.

Q: Can I add Google or Microsoft to the same SPF?

Only if those hosts actually send for the domain. Each include: counts toward the 10-lookup SPF limit. A cold-email domain should not carry every SaaS you ever used.

EmailPal writes MX, SPF, dual DKIM and DMARC p=reject for you, then re-verifies them on public resolvers. This page is the full setup guide: what each record does, what we publish, BYO copy-paste rules, and how to debug a red check.

You usually do not paste records by hand

On domains EmailPal registered, setup publishes MX, SPF, dual DKIM and DMARC, then looks them up from public resolvers. A green check means the internet sees them, not that our nameserver agrees with itself.

That is the same job Instantly's "How to Set Up DNS Records (MX, SPF, DKIM, DMARC)" and Smartlead's "DMARC, DKIM, SPF & MX Setup" articles exist for. On EmailPal-hosted DNS you do not perform it. On a domain you brought, you copy what the dashboard shows — once.

Pre-warmed inventory already has these records. Do not edit them.

What each record is for

Record	Job	EmailPal default
MX	Where replies are delivered	Points at EmailPal so mail can land in the unified inbox
SPF	Which servers may send for the domain	`v=spf1 include:_spf.emailpal.io -all` (hard fail)
DKIM	Cryptographic signature on the message	Two selectors: `rsa._domainkey` (RSA-2048) and `ed._domainkey` (Ed25519)
DMARC	What to do if SPF or DKIM fail	`p=reject` at `_dmarc`

Inbox providers (and Gmail/Yahoo's 2024 bulk-sender rules) treat missing authentication as a reason to spam-folder or reject. Authentication is not warmup and it is not list verification. It is the ID check. See Google and Yahoo sender requirements.

Longer primers: What is SPF, What is DKIM, What is DMARC. Why reject rather than none: Why DMARC is p=reject.

If EmailPal is the DNS

Register the domain in EmailPal, or bring your own and delegate nameservers to us.
Wait. The dashboard re-checks public DNS.
Do not add a second SPF TXT "from your old ESP." One SPF record per name.
If a check stays red after propagation, see DNS verification failed.

If you copy records into Cloudflare, Namecheap, GoDaddy, Route 53

Bring your own domain without delegating nameservers means you paste what we show.

Rules that actually break people:

Two SPF records on @. Merge include: values into one v=spf1 ... string. A second TXT starting v=spf1 fails SPF.
Truncated DKIM. RSA-2048 keys are long. Some registrar UIs wrap them into two records. Paste as one TXT. DKIM not validating.
Wrong record type. CNAME vs TXT vs MX — use what the dashboard asks for, not what a generic blog used for Google Workspace.
DMARC set to p=none "to be safe." On an EmailPal sending domain there is no second marketing ESP to discover. p=none just lets spoofed mail through. We want p=reject.
Looking only at the registrar preview. We verify against 8.8.8.8 / 1.1.1.1. The registrar UI lying is why the check exists.

How long it takes

Minutes to a few hours depending on TTL and the registrar. EmailPal re-checks. You do not need to refresh twenty times. A red check that turns green without you touching anything was propagation.

FAQs

Do Done-For-You / pre-warmed domains need this setup?

No. Pre-warmed domains and accounts already have MX/SPF/DKIM/DMARC. Fresh domains we register get the same treatment at provision time.

Can I set these up on a free Gmail address?

No. SPF/DKIM/DMARC are domain records. gmail.com is Google's domain. Use a domain you control.

Instantly / Smartlead says DKIM is missing on an EmailPal domain

Their domain test looks for *their* selector, not ours. If you connected an EmailPal mailbox as SMTP, authenticate as EmailPal documents. The sending domain's DKIM is the one we published.

Does SPF `-all` hurt deliverability?

No. It stops other people from sending as you. Deliverability is reputation, list and copy. A soft fail (~all) on a cold-email domain is an invitation to impersonate it.

Can I add Google or Microsoft to the same SPF?

Only if those hosts actually send for the domain. Each include: counts toward the 10-lookup SPF limit. A cold-email domain should not carry every SaaS you ever used.

Need more help?

Open a support ticket with the domain name, or read SPF, DKIM, DMARC and MX.