Business Email DNS: MX, SPF, DKIM & DMARC Checklist

MX, SPF, DKIM and DMARC answer different questions about your company email. MX tells senders where to deliver incoming mail. SPF and DKIM help receiving systems authenticate outgoing mail. DMARC connects authentication to the visible From domain and publishes a policy for messages that fail its checks.

This checklist helps an administrator review business-domain email setup. Use the exact records supplied by your hosting and sending services. The examples here describe decisions to make; they are not DNS values to paste into a production zone.

Start with the complete sender list#

List the services sending on behalf of your business: employee mailboxes, website forms, invoices, support, CRM and newsletters. A policy that works for one mailbox can still break a legitimate application that sends differently. Identify the owner of each sending system and collect its provider’s instructions.

Check the authoritative DNS provider rather than editing an inactive copy of the zone. Record the current configuration before changing it, including record names and TTLs. Domain verification, incoming routing and outgoing authentication are separate checks.

Check MX routing for incoming mail#

Publish the destination MX records supplied by the email host and confirm the required mailboxes exist. Test delivery to the company domain from an external address. Review any remaining records from an old provider with the migration owner rather than leaving conflicting routing by accident.

MX changes do not import historical mail or contacts. Keep the source service available during an agreed migration window and follow a business email migration checklist for reconciliation and rollback.

Review one coherent SPF policy#

SPF identifies authorised sending infrastructure for the envelope-sender domain. Review every legitimate sender before editing the policy, and avoid publishing multiple conflicting SPF records for the same name. Your provider’s documentation should determine the required mechanisms and limits.

Do not assume that SPF passing alone proves the visible From identity is aligned for DMARC. Examine an actual received message’s authentication results and compare the domains involved.

Verify DKIM signing using a delivered message#

DKIM uses a signature associated with a domain and a public key published in DNS. Obtain the selector and record value from the sending service. Check whether the DNS interface expects a relative name, and avoid duplicating the domain suffix.

After enabling the supplied configuration, send a representative message and inspect its headers at the recipient. A DNS record existing is not the same as the service actively signing with it. Repeat checks for each separate business sending service.

Plan DMARC alignment and policy carefully#

DMARC evaluates alignment between the visible From domain and a passing SPF or DKIM identity. Review reports and legitimate senders before tightening enforcement. An aggressive policy applied without a sender inventory can interfere with real company messages.

Google’s email sender guidelines distinguish requirements for all senders from those sending more than 5,000 messages per day to personal Gmail accounts. Check the current rules directly for your sending pattern. Authentication, reputation, recipient consent and message quality all affect delivery; no record guarantees inbox placement.

Keep a small acceptance record#

For each sender, record the tested From address, recipient provider, timestamp and authentication outcome. Review bounced messages and repeat checks after changing providers or adding a new application. Keep credentials outside the checklist.

For Aiinak, company email hosting starts with a business workspace and a domain you control. Follow the custom-domain setup guide and the records supplied by your workspace. Domain registration and website hosting remain separate services.