Email and DNS – set up MX, SPF, DKIM and DMARC

In short

For email to work for your domain, you need four things in DNS: an MX record (where mail for you goes), SPF (who may send on your behalf), DKIM (a digital signature) and DMARC (what should happen to forgeries). For Nexthosting mailboxes, the MX points to mail.<your-domain> and SPF is v=spf1 include:_spf.nexthosting.net ~all. You copy the DKIM key from the web panel.

Why do I need this?

Without these records, mail either does not arrive at all (MX missing) or lands in spam because the recipient cannot verify that you really sent it. Large providers such as Gmail and Microsoft require SPF, DKIM and DMARC, especially from senders who send a lot of mail.

Record	Answers the question	Type in DNS
MX	Where should mail to @meinprojekt.de go?	MX
SPF	Which servers may send mail with my sender address?	TXT
DKIM	Was the mail altered on the way, and does it really come from me?	TXT or CNAME
DMARC	What should the recipient do if SPF and DKIM do not match?	TXT

What a recipient checks when your mail arrives

1. ▶Mail arrivesSender: info@meinprojekt.de
3. 2SPFMay this server send for meinprojekt.de?
5. 3DKIMIs the signature correct?
7. 4DMARCWhat should happen on failure?
9. ✓Inbox, spam or rejected

Prerequisite: create mailboxes

Web hosting and WordPress hosting include mailboxes (10 to 250, depending on the plan). How to create them is explained in Email mailboxes. Afterwards the web panel shows you which DNS records are needed for the domain. In the browser you read your mail at webmail.nexthosting.net.

If your domain uses the Nexthosting nameservers (ns1.nexthosting.net and ns2.nexthosting.net), you can set the records in the DNS editor of the web panel (Manage DNS records). If the domain is at another provider with its own nameservers, you have to create the records there.

Use your own values, do not copy these

meinprojekt.de stands for your domain. The DKIM key (and the address for the A record of mail) is shown by the web panel for the domain or in the email setup. Use exactly those values; do not make any up and do not copy them from other domains.

MX record

The MX record names the mail server that accepts mail for your domain. It has a priority: the lowest value is tried first.

@  3600  IN  MX  10  mail.meinprojekt.de.

For Nexthosting mailboxes the target is mail.<your-domain>, e.g. mail.meinprojekt.de. This name points to the web hosting server. If your domain uses the Nexthosting nameservers, check in the DNS editor of the web panel that the MX record and the record for mail exist. If DNS is managed elsewhere, create the MX record there plus an A record for mail with the address from the web panel. The target must be a name, not an IP address, and must not be a CNAME. Delete old MX records from a previous provider, otherwise part of your mail arrives there.

SPF

SPF is a TXT record on the main domain. It lists the servers that may send on your behalf. For Nexthosting mailboxes it is:

@  3600  IN  TXT  "v=spf1 include:_spf.nexthosting.net ~all"

If another service also sends mail with your domain (newsletter tool, shop system), add it to the same record. spf.beispiel-dienst.example stands for the value that service gives you:

@  3600  IN  TXT  "v=spf1 include:_spf.nexthosting.net include:spf.beispiel-dienst.example ~all"

Part	Meaning
v=spf1	Identifies SPF (mandatory at the start)
include:_spf.nexthosting.net	The Nexthosting mail servers may send
a	The A record of your domain may send
mx	The mail servers from your MX records may send
include:…	Another service may send (newsletter tool, shop system)
~all	Everyone else: “soft fail” (mail is treated as suspicious)
-all	Everyone else: “hard fail” (mail is rejected)

Rules:

• Only one SPF record per domain. Several TXT records with v=spf1 make SPF invalid. Combine all services in one record.
• A maximum of 10 DNS lookups (include, a, mx …) in total.
• Start with ~all and only switch to -all once you are sure all senders are covered.

DKIM

DKIM digitally signs every outgoing mail. The recipient fetches the public key from DNS and checks the signature.

selector._domainkey  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq…"

• The selector (here selector) and the key value (p=…) come from the web panel for Nexthosting mailboxes. The value is long; copy it completely and without line breaks.
• Some providers let the value be split into several parts in quotation marks. That is normal.
• If you have your own domain authentication at a newsletter or shop service, you get an additional DKIM record from there. Several selectors are allowed.

DMARC

DMARC ties SPF and DKIM together and defines what happens on failure. It is a TXT record at _dmarc.

_dmarc  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@meinprojekt.de"

Option	Meaning
p=none	Only observe, block nothing (starting point)
p=quarantine	Suspicious mail goes to spam
p=reject	Reject forged mail
rua=mailto:…	Where aggregate reports are sent

Start with p=none, look at the reports for one to two weeks, and then tighten step by step.

Check

nslookup -type=MX meinprojekt.de
nslookup -type=TXT meinprojekt.de
nslookup -type=TXT _dmarc.meinprojekt.de

dig MX meinprojekt.de +short
dig TXT meinprojekt.de +short
dig TXT _dmarc.meinprojekt.de +short

Send a test mail to a Gmail account: there, “Show original” displays the results for SPF, DKIM and DMARC (PASS or FAIL).

Mail lands in spam or does not arrive

Mail to you does not arriveCheck MX records and nameservers→

Mail from you lands in spamCheck SPF, DKIM and DMARC→

Mail from the shop or newsletter lands in spamAdd the service to SPF and enter its DKIM→

Message "Server not found" when sendingCheck the mailbox settings in your mail program: server mail.<your-domain>, SMTP 465 or 587 with authentication→

Frequently asked questions

Do I have to set all four records?

MX is mandatory for receiving. SPF, DKIM and DMARC are practically mandatory for sending if you want mail to arrive reliably.

My domain is at my old provider and my email is there. What should I do?

Leave the MX and TXT records there. Only the website records (A, AAAA, CNAME) point to Nexthosting. See Connect a domain to your website.

Does one record cover several domains?

No, every domain needs its own records.

Further reading

• Set up email mailboxes
• Manage DNS records
• DNS basics
• Solving DNS problems