Setting Email DNS Records

Four DNS records control how email works for your domain. Missing or incorrect records are the most common cause of email going to spam or being rejected.

MX record: mail routing

Tells other mail servers where to deliver email for your domain.

Type: MX
Name: yourdomain.com.
Value: mail.yourdomain.com.
Priority: 10
TTL: 3600

Also add an A record for mail.yourdomain.com pointing to your server IP.

SPF record: sender authorization

Prevents spoofing by listing which mail servers are authorized to send mail for your domain.

Type: TXT
Name: yourdomain.com.
Value: v=spf1 ip4:YOUR_SERVER_IP include:mailchannels.net ~all
TTL: 3600

RemarkableCloud routes outbound mail through MailChannels. The `include:mailchannels.net` directive is required: without it, mail sent from your server may be rejected or go to spam.

SPF flags explained:

• ip4:YOUR_IP: authorizes your server IP directly
• include:mailchannels.net: authorizes the MailChannels relay
• ~all: soft fail for unauthorized senders (goes to spam rather than rejected)
• -all: hard fail (rejected outright): use only when confident all senders are listed

DKIM record: email signing

DKIM adds a cryptographic signature to outgoing mail. Receiving servers verify the signature against your DNS record to confirm mail wasn’t tampered with.

Getting your DKIM key from cPanel

1. cPanel → Email → Email Deliverability
2. Click Manage next to your domain
3. If DKIM isn’t set up, click Install: cPanel generates the key and adds the DNS record automatically (if it manages your DNS)
4. If you manage DNS externally, copy the TXT record shown and add it manually

The record looks like:

Type: TXT
Name: default._domainkey.yourdomain.com.
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA... (long key)
TTL: 3600

DMARC record: policy enforcement

DMARC tells receiving servers what to do with mail that fails SPF or DKIM. It also requests reports so you can monitor abuse.

Type: TXT
Name: _dmarc.yourdomain.com.
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
TTL: 3600

DMARC policy options:

• p=none: monitor only, take no action (use when first setting up)
• p=quarantine: failing mail goes to spam (recommended)
• p=reject: failing mail is rejected outright (use once delivery is stable)

Verifying your records

Use mail-tester.com: send an email to the address shown and it scores your setup out of 10 with specific recommendations.

Or use MXToolbox:

# Check MX
dig yourdomain.com MX +short

# Check SPF
dig yourdomain.com TXT +short | grep spf

# Check DKIM
dig default._domainkey.yourdomain.com TXT +short

# Check DMARC
dig _dmarc.yourdomain.com TXT +short

Common issues

Mail going to spam despite correct records Check your server IP against blacklists at mxtoolbox.com/blacklists. A single listing can override all your DNS work.

“550 SPF check failed” bounces Your SPF record doesn’t authorize the sending IP. Add the missing IP or include to your TXT record.

DKIM verification failing Key mismatch: the key in DNS doesn’t match what the server is signing with. Regenerate the DKIM key in cPanel → Email Deliverability and update the DNS record.