DNS Records Guide for Sender Domains

SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses and servers are authorized to send email on behalf of a domain.

Record Format

• Type: TXT record on the root domain
• Syntax: v=spf1 <mechanisms> <qualifier>
• Example: v=spf1 include:_spf.google.com include:spf.emailelement.com -all

Common Mechanisms

Qualifiers

Important Rules

• Max 10 DNS lookups: Each include:, a, mx, and redirect counts as a lookup. Exceeding 10 causes SPF to fail (PermError).
• One SPF record per domain: Multiple TXT records starting with v=spf1 will cause failures. Merge them into one.
• Order matters: Mechanisms are evaluated left to right. Place most common sources first.

Examples by Provider

# Google Workspace + EmailElement
v=spf1 include:_spf.google.com include:spf.emailelement.com -all

# Microsoft 365 + EmailElement
v=spf1 include:spf.protection.outlook.com include:spf.emailelement.com -all

# Amazon SES + EmailElement
v=spf1 include:amazonses.com include:spf.emailelement.com -all

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to outgoing emails, allowing receivers to verify the message was not altered in transit and was authorized by the domain owner.

Record Format

• Type: CNAME or TXT record
• Host: <selector>._domainkey.yourdomain.com
• Value: Public key or CNAME target provided by EmailElement

How EmailElement Provides DKIM

1. When you create a Sender Domain, EmailElement generates a DKIM key pair.
2. The selector and CNAME target are displayed on the Sender Domain page.
3. Add the CNAME record at your DNS provider pointing to the EmailElement-provided target.
4. EmailElement signs outgoing emails with the private key; receivers verify using the public key in DNS.

Key Rotation

• EmailElement handles key rotation automatically when using CNAME records.
• If using TXT records with a raw public key, you must manually update when keys rotate.
• CNAME records are recommended because they allow seamless rotation.

Selector Format

• Selectors are unique identifiers: e.g., ee1._domainkey.yourdomain.com
• Multiple DKIM selectors can coexist (one per signing service)

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC builds on SPF and DKIM to tell receivers what to do when authentication fails and where to send reports.

Record Format

• Type: TXT record
• Host: _dmarc.yourdomain.com
• Example: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Policy Options

Recommended Progression

1. Start with p=none and set rua= to receive aggregate reports
2. Review reports for 2-4 weeks to identify legitimate senders not yet authenticated
3. Move to p=quarantine once all legitimate sources pass SPF/DKIM
4. Move to p=reject for maximum protection after confirming no false positives

Common Tags

MX Record for EmailElement

Purpose

Configuring an MX record for EmailElement allows the platform to handle incoming reply-to email for your sender domain. This enables reply tracking and management within the EmailElement dashboard.

When to Use

• Use MX: When you want EmailElement to capture and track replies. Leave the ReplyTo Email field blank on the sender domain form.
• Do not use MX: When you want replies to go to a specific mailbox (e.g., support@yourdomain.com). Set the ReplyTo Email field instead.

Record Format

• Type: MX record
• Host: The subdomain or domain used for reply handling
• Value: Provided by EmailElement on the Sender Domain page
• Priority: 10 (or as specified by EmailElement)

Setup

1. Navigate to Sender Domains > select your domain
2. Note the MX record value displayed
3. Add the MX record at your DNS provider
4. Click Validate DNS Records to confirm