Sending domains and DNS

A receiving mail server decides whether to trust a message partly from the DNS records of the domain in its From address. These records show that your mail is authorized to come from that domain. This page explains what to publish, how SecureThread checks it, and what each result means.

Why the records matter#

• SPF lists the servers that may send mail for your domain.
• DKIM signs each message with a key published in your DNS. The receiving server checks the signature against that key.
• DMARC tells receiving servers what to do with mail that fails the checks, and where to send reports. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From domain. That match is called alignment. DKIM alignment survives forwarding. SPF alignment often does not.

Large mailbox providers, including Google and Yahoo, expect senders to authenticate their mail with these records. Their own help pages set out the current requirements.

SecureThread counts a domain as verified when four checks pass: the ownership record, SPF, DKIM and DMARC. A DMARC record with p=none counts as published, with a warning.

Add a domain#

1. Open Administration › Sending domains and choose Add a domain.
2. Enter the domain, such as example.com. Enter the domain only, with no www, no @ and no address.
3. If your sending provider gave you a DKIM selector, enter it. Leave the field empty to try the usual selectors.
4. Choose Add domain. While the domain is not verified, its card lists the records to publish. Once it is verified, choose DNS records on the card to show them.

A workspace can have up to 25 sending domains. Adding a domain that is already on the list is refused with "This domain is already on the list." Personal mail domains such as gmail.com and outlook.com belong to their providers. Your organization cannot verify them.

The records#

The app works out each record for your domain. Replace the placeholders with the values the app shows. The values for DKIM and some SPF records come from your sending provider.

• Ownership proves that your organization controls the domain. Keep it published. SecureThread checks it again on a schedule.
• SPF: a domain has exactly one SPF record. Two SPF records are an error. Put every sending service into that one record. A record may make at most 10 DNS lookups, and each include: counts, including the includes inside it.
• DKIM: your sending provider generates the key and names the selector. Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey, which point to the values its portal shows.
• DMARC: start with p=none and an address you read in rua. Move to p=quarantine or p=reject once reports show that your mail passes.

SPF and DKIM values for common providers#

The table lists the values the app used when this page was written. Your provider's own dashboard is the authority, and the setup guide in the app shows the current values for the providers you use.

For other sending services, the setup guide in the app names where to copy each value from.

Add the records at your DNS host#

Your DNS host is where the domain's DNS records are managed. It can differ from your mail provider.

1. Sign in to the DNS host and open the DNS records for the domain.
2. Add a record with the type the app shows, TXT or CNAME.
3. In the Name or Host field, enter only the part before your domain. Enter _securethread, not _securethread.example.com. For the SPF record, enter @ if the host uses it for the domain itself. Most hosts add the domain for you. If you type the full name, the host adds the domain again and the record lands at the wrong name. The app reports this as a doubled name.
4. Paste the value exactly as shown. Do not add quotation marks unless your host requires them around the whole value. Some hosts split long TXT values into pieces. That is normal.
5. Save the record. Then return to SecureThread and choose Check now.

Domain statuses#

Record results#

Each check shows one of these results.

Messages and fixes#

Use this table to match a message with its fix. <domain> stands for your domain.

Messages in the domain card:

Checks and re-checks#

• After you add a domain, SecureThread checks it every hour for seven days. Choose Check now at any time. A check you start restarts the hourly checks if they have stopped.
• A verified domain is checked every 12 hours.
• When a verified domain fails a check, its status becomes Failing checks. The card shows the date its grace period ends. Mail can still be sent until then, which is 72 hours after the first failed check.
• After 72 hours of failing, mail from the domain is refused with the code SENDER_DOMAIN_NOT_VERIFIED until the records check out.
• A check that passes makes the domain Verified again. Sending from it resumes without further action.

How long DNS changes take#

The app's guidance is that new records usually show within minutes, but some DNS hosts take up to 48 hours. A new or changed record appears once your DNS host publishes it and the resolvers that receiving servers use pick it up. The time depends on the record's TTL, which is how long resolvers keep an answer, and on your DNS host. Choose Check now after you publish the records.

Check the records yourself#

Any DNS lookup tool shows what is published at a name, such as _dmarc.<domain> for a TXT record. It is a useful second check. SecureThread's own check decides verification.