[ Technical ]

MX Records and Email Setup: A Complete Configuration Guide

Setting up email for a domain involves MX records, SPF, DKIM, and DMARC. Get one wrong and your email ends up in spam or does not deliver at all.

· · 7 min read

MX Records and Email Setup: A Complete Configuration Guide

Email configuration is the DNS task that causes the most support requests. The records are straightforward individually, but getting all four components correct — MX, SPF, DKIM, DMARC — requires careful setup. Missing any one of them degrades deliverability or breaks email entirely.

MX Records: Where Your Email Goes

An MX (Mail Exchanger) record tells other mail servers where to deliver email for your domain. Without MX records, nobody can send email to addresses at your domain.

An MX record has two required fields: priority and the mail server hostname.

@ IN MX 10 mail1.yourprovider.com.
@ IN MX 20 mail2.yourprovider.com.

The priority number (10, 20) tells sending servers which server to try first. Lower number = higher priority. If the priority 10 server is unreachable, the sender tries the priority 20 server.

For most email services (Google Workspace, Microsoft 365), the provider gives you their specific MX hostnames and priority values. Copy them exactly — the priority numbers differ per provider.

Google Workspace MX records (2027):

aspmx.l.google.com.         priority: 1
alt1.aspmx.l.google.com.    priority: 5
alt2.aspmx.l.google.com.    priority: 5
alt3.aspmx.l.google.com.    priority: 10
alt4.aspmx.l.google.com.    priority: 10

After adding MX records, verify with:

dig MX yourdomain.com +short

SPF: Authorising Your Sending Servers

SPF (Sender Policy Framework) is a TXT record that specifies which servers are allowed to send email from your domain. Without SPF, receiving servers have no way to verify whether an email claiming to be from @yourdomain.com is legitimate.

@ IN TXT "v=spf1 include:_spf.google.com ~all"

The include: directive pulls in the sender list from Google's SPF record (or whichever provider you use). The ~all at the end means "fail softly for anything not in this list" — messages from unauthorised servers go to spam rather than being rejected outright. Use -all for a hard reject policy once you are confident your setup is complete.

One SPF record per domain. You cannot have two TXT records starting with "v=spf1". If you need to authorise multiple services (email provider plus a CRM that sends on your behalf), merge them into one record:

"v=spf1 include:_spf.google.com include:sendgrid.net ~all"

DKIM: Signing Your Outgoing Email

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email headers. Receiving servers can verify the signature using the public key published in your DNS.

Your email provider generates a key pair. You publish the public key in DNS as a TXT record:

google._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQ..."

The selector (google in this case) is specified by the provider. It allows multiple DKIM keys per domain — useful if you use multiple sending services.

DKIM setup is done in your email provider's admin console. Google Workspace has a specific setup wizard under Apps > Google Workspace > Gmail > Authenticate Email. Follow the provider's instructions exactly.

DMARC: Telling Receivers What to Do

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a policy record that tells receiving servers what to do when email fails SPF or DKIM checks.

_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

The p= value sets the policy:

  • p=none — monitor only, take no action
  • p=quarantine — send failing mail to spam
  • p=reject — block failing mail

Start with p=none and add rua= to get aggregate reports. The reports arrive as XML files showing what passed and failed. After a week of clean reports, move to p=quarantine. After another week, move to p=reject.

Jumping straight to p=reject before verifying your setup is correct can cause legitimate email to be blocked.

Testing Your Setup

After configuring all four records, use MXToolbox (mxtoolbox.com) or Google Admin Toolbox to verify:

  • MX records resolve correctly
  • SPF record is syntactically valid
  • DKIM key is published and matches the selector
  • DMARC record is present and valid

Also send a test email to mail-tester.com. It gives a score out of 10 and flags specific issues. A score of 9 or 10 means your email authentication is correctly configured.