Email depends on the Domain Name System more than most people realise. When someone sends a message to your address, DNS tells their server where to deliver it. When you send a message, DNS lets the receiving server check that you are who you say you are. This guide explains the DNS records used for email: MX, A, TXT, CNAME and PTR, how SPF, DKIM and DMARC use TXT records, how to read and add them, and the mistakes that cause lost or rejected mail.
What is a DNS record?
A DNS record is a line of data stored for your domain at a DNS host. Each record has a name, a type, a value and a TTL. The name says which host it belongs to, such as the bare domain or a subdomain. The type says what kind of data it holds. The value is the data itself. The TTL, short for time to live, tells other systems how long they may keep a copy before they ask again.
You manage records where your domain's DNS is hosted, which may be your registrar, a hosting company or a separate DNS service. The records matter wherever you edit them, and changes may take time to reach everyone because copies are cached for the length of the TTL.
Which DNS record is used for email?
Several types work together. This table lists the ones you will meet.
| Type | What it does for email | Example use |
|---|---|---|
| MX | Names the mail servers that accept mail for the domain, with a priority | Where incoming mail is delivered |
| A / AAAA | Maps a hostname to an IPv4 or IPv6 address | The address of the mail server named in an MX record |
| TXT | Holds free text that other systems read | SPF, DKIM public keys, DMARC policy |
| CNAME | Makes one name an alias of another | A provider's DKIM or tracking host |
| PTR | Reverse lookup from an IP address to a name | Matching a sending IP to a hostname |
MX records: where incoming mail goes
An MX (mail exchanger) record points to the server that receives mail for the domain. A domain can have several, each with a priority number. A sending server tries the lowest number first and falls back to the next if it is unreachable. The target of an MX record must be a hostname, not an IP address, and that hostname needs its own A or AAAA record.
If you use a hosted mailbox service, such as Google Workspace or Microsoft 365, the provider gives you the MX records to publish. If you remove them or enter them wrongly, incoming mail stops. If you change them, do it with care and keep the old values written down.
MX records are only about receiving. They do not say who may send mail for your domain. A domain used only to send, for example from an application, may have no MX records at all, though it is a good idea to publish them so that bounces and replies to that domain have somewhere to go.
TXT records: SPF, DKIM and DMARC
A TXT record holds text. Three email standards use it to let receivers check a message.
- SPF is a TXT record on your domain that lists which servers may send mail using that domain. A receiving server compares the sending IP to the list. Read the SPF record guide for the syntax.
- DKIM publishes a public key in a TXT record at a name such as
selector._domainkey.example.com. Your sending system signs each message with the matching private key, and the receiver uses the public key to verify it. See the DKIM setup guide. - DMARC is a TXT record at
_dmarc.example.comthat tells receivers what to do when SPF and DKIM do not line up with the From domain, and where to send reports. See how to set up DMARC.
Our article on authenticating your sending domain walks through all three in order. An example of the text in each record looks like the examples below, with your own values in place of the placeholders.
example.com. TXT "v=spf1 include:_spf.provider.example ~all" selector._domainkey TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY_HERE" _dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Never copy these values. Use the exact values your provider gives you.
One SPF record per domain
A domain should publish only one SPF record. If you use more than one sending service, combine them into a single record. Two SPF records at the same name cause a permanent error and break SPF for the domain. The record is also limited in the number of DNS lookups it may trigger, and going over the limit fails. Our guide on SPF too many lookups explains how to fix it.
Long TXT values
Some DKIM keys are longer than a single string allows, so DNS hosts split them into several quoted parts. Most DNS tools handle this for you. If a value is rejected, check whether your host wants one string or several, and that no spaces or line breaks have been added to the key.
CNAME records for email
A CNAME turns one name into an alias of another. Email providers often ask you to add CNAME records so they can manage a key or a tracking domain for you. A DKIM selector can be a CNAME that points to a name controlled by your provider, which lets the provider rotate keys without asking you to edit DNS again. A name that has a CNAME cannot hold other record types, and a CNAME is not allowed at the bare domain next to MX and TXT records.
PTR records and reverse DNS
A PTR record maps an IP address back to a hostname. Some receiving servers check that a sending IP has a reverse record and that it points to a name that resolves back to the same IP. You do not set a PTR record in your own domain's DNS. The owner of the IP address block, usually your hosting company or your sending provider, sets it. If you run your own mail server, ask your host to set it. If you use a service with shared or dedicated IPs, the provider handles it.
How to check your email DNS records
- List the records at your DNS host, and write down the MX, SPF, DKIM and DMARC entries.
- Use a lookup tool or the command line, for example
dig MX example.comanddig TXT example.com, to see what the public internet sees. The result can differ from your DNS panel while a change is propagating. - Run our free SPF, DKIM and DMARC checker to test the syntax and alignment.
- Send a test message to a mailbox you own and read the authentication results in the message headers.
Common mistakes
- Entering the record name wrongly. Some hosts add your domain automatically, so typing the full name produces
name.example.com.example.com. Check how your host treats the name field. - Adding a second SPF record instead of editing the first.
- Forgetting a sender. A newsletter tool or CRM that sends as your domain needs to be included, or its mail fails checks.
- Putting an IP address in an MX record. It must be a hostname.
- Starting DMARC at a strict policy before checking reports, which can reject legitimate mail. Begin with monitoring.
- Low patience. Changes can take time to spread. Wait for the old TTL to pass before judging the result.
- Deleting records you do not recognise. They may belong to a service that is still in use.
Summary
MX records bring mail in. TXT records, in the form of SPF, DKIM and DMARC, prove that the mail you send is yours. CNAME records let providers manage some of those for you, and PTR records tie your sending address back to a name. Get these right once, check them after each change, and most delivery problems caused by DNS will not occur.
Check your domain's email DNS now Our free checker reads your SPF, DKIM and DMARC records and shows what to fix.
References and further reading
Frequently asked questions
What DNS record is used for email?
MX records name the servers that receive mail for a domain. TXT records carry SPF, DKIM and DMARC for sender checks. A and AAAA, CNAME and PTR records support them.
What is a TXT record used for in email?
It holds text that receivers read to check a sender, including the SPF list of allowed servers, the DKIM public key and the DMARC policy.
Can I have more than one SPF record?
No. A domain should publish one SPF record. Merge all senders into it, because two records cause a permanent error.
Do I need an MX record to send email?
Sending does not need one. MX records are for receiving. A sending domain should still have them so that replies and bounces have somewhere to go.
Who sets a PTR record?
The owner of the IP address, usually your host or your sending provider, sets it. You do not add it in your own domain's DNS.