Overview #
To send emails from your domain using our platform, you’ll need to add a few DNS records. These records prove to inbox providers (like Gmail, Outlook, etc.) that we’re allowed to send on your behalf, and they help ensure your messages don’t end up in spam.
The records you’ll need depend on whether you’re using MAIL FROM masking (recommended) or spoof-style masking.
Required Records for MAIL FROM Masking #
This setup requires that you’re not already using the mail. subdomain for receiving email (i.e. no existing MX records on mail.yourdomain.com).
| Record Type | Where to Add It | Required? | Purpose |
|---|---|---|---|
| ✅ MX | mail.yourdomain.com | Yes | Confirms that mail. is a valid subdomain (even though it won’t receive mail) |
| ✅ SPF (TXT) | mail.yourdomain.com | Yes | Authorises Amazon SES to send email from mail. |
| ✅ DKIM (CNAME) | Three records under yourdomain.com | Yes | Authenticates email content and prevents tampering |
| ✅ Return-Path Domain (MAIL FROM) | Configured in our system | Yes | Used by AWS SES for bounce handling and SPF alignment |
Required Records for Spoof-Style Masking #
This is the fallback option if you’re already using mail. for receiving email. It requires fewer records but offers less alignment with DMARC.
| Record Type | Where to Add It | Required? | Purpose |
|---|---|---|---|
| ✅ DKIM (CNAME) | Three records under yourdomain.com | Yes | Authenticates the message source using a cryptographic signature |
| ⚠️ SPF (TXT) | yourdomain.com | Recommended | Informs inboxes that Amazon SES is allowed to send mail from your domain |
| ❌ MX | Not needed | No | No MAIL FROM domain means no MX needed for this purpose |
What Each Record Does #
| Record | Description |
|---|---|
| 📨 MX | Used with MAIL FROM masking. It makes the mail. subdomain valid for bounce handling and authentication. This does not forward emails. |
| 🔐 SPF | A TXT record that lists Amazon SES as an authorised sender. It helps inboxes know that emails from your domain are legitimate. |
| 🧾 DKIM | A set of CNAME records generated by AWS SES. They digitally sign your messages to prove they weren’t changed in transit. |
| 🎯 MAIL FROM / Return-Path | A setting in our platform. When enabled, emails are sent with a Return-Path at mail.yourdomain.com, aligning with SPF and DMARC. |
Summary: What You’ll Need #
| Masking Method | MX Record | SPF | DKIM | DNS Notes |
|---|---|---|---|---|
| ✅ MAIL FROM masking | Yes (under mail.) | Yes (mail. subdomain) | Yes (3 CNAMEs) | Can only be used if mail. subdomain is not already in use |
| ⚠️ Spoof-style masking | No | Recommended (root domain) | Yes (3 CNAMEs) | Works if mail. subdomain is unavailable or already used for incoming mail |
All DNS changes should be made through your DNS provider — typically GoDaddy, Cloudflare, or your domain registrar. These changes usually take effect within a few hours, but in some cases can take up to 72 hours to fully propagate.
