DNS records explained
SPF, DKIM and DMARC are how Gmail, Yahoo and Outlook decide whether an email really comes from you. Here is what each record does and how to combine it with what you already have.
SPF
SPF is a TXT record on your domain that lists the servers allowed to send email for it.
Only one SPF record per domain
A domain must have exactly one record that starts with v=spf1. If you already have one (for Google Workspace, Microsoft 365 or your website host), do not add a second one. Merge them instead.
Example of a merged record. Your values will differ:
v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all
Keep one v=spf1 at the start and one all at the end, with every source in between.
DKIM
DKIM signs every email with a private key that only MailHoor holds for your domain. Inboxes check the signature against the public key you publish as a TXT record at <selector>._domainkey.yourbrand.com. MailHoor uses 2048-bit keys, and the signature is aligned with your domain for DMARC.
DMARC
DMARC is a TXT record at _dmarc.yourbrand.com. It tells inboxes what to do with mail that fails SPF and DKIM, and where to send reports.
A safe way to start:
v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com
| Policy | Meaning |
|---|---|
p=none |
Only report. Use it while you check that everything passes. |
p=quarantine |
Send failing mail to spam. |
p=reject |
Refuse failing mail. |
Once all your sending services pass, move to p=quarantine. If you already have a DMARC record, keep it; you need only one.
Bounce CNAME (mhbounce)
mhbounce.yourbrand.com is a CNAME that points to bounce.mailhoor.com. Bounces then return to an address on your own domain, so the SPF check is aligned with your From address. This improves DMARC results and delivery.
Check your records
The Sending domains page shows the live status of every record. You can also check from any computer:
nslookup -type=TXT _dmarc.yourbrand.com
nslookup -type=CNAME mhbounce.yourbrand.com