DNS setup
Four records make your domain a mail domain: MX to receive, SPF and DKIM to prove your outbound mail is yours, DMARC to say what happens when it isn't.
yourco.com as a stand-in.The records
| Type | Host / Name | Value | TTL |
|---|---|---|---|
| MX | @ | 10 mx1.mail.atrix.dev | 3600 |
| TXT | @ | v=spf1 include:mail.atrix.dev ~all | 3600 |
| CNAME | am1._domainkey | am1.dkim.mail.atrix.dev | 3600 |
| TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@mail.atrix.dev | 3600 |
What each record does
MX tells the world where mail for @yourco.com should be delivered — our edge, mx1.mail.atrix.dev. Priority 10 is conventional; the number only matters relative to other MX records, and you should remove any existing ones from a previous provider.
SPF (a TXT record on the apex) lists the servers allowed to send mail claiming to be from your domain. The include:mail.atrix.dev mechanism delegates that list to us. A domain may have only one SPF record — if you already have one, merge our include into it rather than adding a second:
# merging with an existing Google Workspace SPF record: v=spf1 include:_spf.google.com include:mail.atrix.dev ~all
DKIM lets receiving servers verify a cryptographic signature we add to every outbound message. The CNAME delegates the selector am1._domainkey to us, which means we can rotate your keys automatically — you never touch DNS again for key hygiene.
DMARC tells receivers what to do with mail that fails SPF and DKIM: p=quarantine sends impostor mail to spam. Start there; move to p=reject once the reports (sent to the rua address, summarized in your dashboard) show only legitimate mail for a couple of weeks.
Registrar notes
- Cloudflare: set the DKIM CNAME to
DNS only(grey cloud) — proxying breaks lookups. - Namecheap / GoDaddy: use
@for the apex host field; some UIs call it"blank"or the domain itself. - Route 53: TXT values must be quoted; the console adds quotes for you, the API does not.
- Some registrars append your domain to host names automatically — if verification stalls, check you haven't created
_dmarc.yourco.com.yourco.com.
Checking propagation
dig MX yourco.com +short dig TXT yourco.com +short dig CNAME am1._domainkey.yourco.com +short dig TXT _dmarc.yourco.com +short
The dashboard re-verifies automatically every few minutes and keeps watching after the initial setup — if a record drifts or is deleted later, the domain flips to attention and you get a domain.failed webhook and an email to your fallback address.