Skip to content
Contact us
  • There are no suggestions because the search field is empty.

Email Masking - DNS Records


Overview

To send emails from your domain using our platform, you'll need to add a few DNS records. These records prove to inbox providers (like Gmail, Outlook, etc.) that we're allowed to send on your behalf, and they help ensure your messages don't end up in spam.

The records you'll need depend on whether you're using MAIL FROM masking (recommended) or spoof-style masking.

Required Records for MAIL FROM Masking

This setup requires that you're not already using the mail. subdomain for receiving email (i.e. no existing MX records on mail.yourdomain.com).

✅ MX
Where to Add It: mail.yourdomain.com
Required?: Yes
Purpose: Confirms that mail. is a valid subdomain (even though it won't receive mail)

✅ SPF (TXT)
Where to Add It: mail.yourdomain.com
Required?: Yes
Purpose: Authorises Amazon SES to send email from mail.

✅ DKIM (CNAME)
Where to Add It: Three records under yourdomain.com
Required?: Yes
Purpose: Authenticates email content and prevents tampering

✅ Return-Path Domain (MAIL FROM)
Where to Add It: Configured in our system
Required?: Yes
Purpose: Used by AWS SES for bounce handling and SPF alignment

Required Records for Spoof-Style Masking

This is the fallback option if you're already using mail. for receiving email. It requires fewer records but offers less alignment with DMARC.

✅ DKIM (CNAME)
Where to Add It: Three records under yourdomain.com
Required?: Yes
Purpose: Authenticates the message source using a cryptographic signature

⚠️ SPF (TXT)
Where to Add It: yourdomain.com
Required?: Recommended
Purpose: Informs inboxes that Amazon SES is allowed to send mail from your domain

❌ MX
Where to Add It: Not needed
Required?: No
Purpose: No MAIL FROM domain means no MX needed for this purpose

What Each Record Does

Record / Description

  • 📨 MX — Used with MAIL FROM masking. It makes the mail. subdomain valid for bounce handling and authentication. This does not forward emails.
  • 🔐 SPF — A TXT record that lists Amazon SES as an authorised sender. It helps inboxes know that emails from your domain are legitimate.
  • 🧾 DKIM — A set of CNAME records generated by AWS SES. They digitally sign your messages to prove they weren't changed in transit.
  • 🎯 MAIL FROM / Return-Path — A setting in our platform. When enabled, emails are sent with a Return-Path at mail.yourdomain.com, aligning with SPF and DMARC.

Summary: What You'll Need

✅ MAIL FROM masking
MX Record: Yes (under mail.)
SPF: Yes (mail. subdomain)
DKIM: Yes (3 CNAMEs)
DNS Notes: Can only be used if mail. subdomain is not already in use

⚠️ Spoof-style masking
MX Record: No
SPF: Recommended (root domain)
DKIM: Yes (3 CNAMEs)
DNS Notes: Works if mail. subdomain is unavailable or already used for incoming mail

All DNS changes should be made through your DNS provider — typically GoDaddy, Cloudflare, or your domain registrar. These changes usually take effect within a few hours, but in some cases can take up to 72 hours to fully propagate.