ESDomain editorial team · Reviewed 2 November 2026
List every service that sends mail
Your mailbox may not be the only service using your domain as a sender. A shop can send receipts, a marketing tool can send campaigns and a website form can generate notifications. List every service, its administrator and the authentication instructions supplied for that account before making any changes to the public DNS zone.
You can manage DNS through ESDomain without purchasing a new mailbox. That does not automatically configure external sending services or guarantee inbox placement. Work from the instructions for your chosen email account. Separate receiving messages from authorising outbound senders: a successful incoming message does not prove that the shop or newsletter is authenticated.
Keep one SPF record per name
If a TXT value beginning v=spf1 already exists at the name you are configuring, do not add a second independent SPF record at that same name. Gather the instructions from every sender and prepare one valid combined policy. An accidental duplicate can break authentication that was working before you introduced a new sending tool.
Do not copy a generic SPF value without checking which providers it authorises. Do not remove an existing authorisation until you know whether that service still sends mail. Save the old value and involve your email administrator when the combination is complex. Other TXT entries may verify ownership and have no connection to SPF.
Publish DKIM for your own account
Obtain the DKIM selector and value from your own provider’s control panel. Use the record type it specifies, which may be TXT or CNAME. Check the relative name expected by the DNS editor so you do not repeat the domain. Never replace the supplied value with a key taken from another account or a public example.
Return to the sending provider after publication and complete any activation or verification it requires. Saving a DNS record does not establish that messages are already being signed. Check a real sample from each sending service. When changing providers, prepare the new records without blindly removing selectors that another active sender still uses.
Introduce DMARC with real checks
DMARC evaluates alignment between the visible sender domain and SPF or DKIM. Before moving to a policy that rejects messages, verify legitimate senders and arrange to review reports. A stricter policy does not repair a forgotten application or a contact form using the wrong sender identity. Prepare those senders before increasing enforcement.
Keep a delivery and reply check for the mailbox and every important application. Repeat those checks when switching nameservers or adding a new tool. If something fails, give support the affected service and the authentication result you observed. This guide organises the work; exact DNS values and activation steps depend on your accounts and providers.