Set up your sending domain and authentication

A dedicated sending domain gives your account its own sending reputation, its own "From" identity, and its own set of DNS authentication records — separate from every other business using the platform. This article walks through adding one, the three DNS records that prove your mail is legitimately yours, and how to confirm it's actually working before you rely on it.

#Why authentication matters

Mailbox providers (Gmail, Yahoo, Outlook, and the rest) don't take your word for it that an email claiming to be from yourbrand.com is really from you. They check three DNS-published records:

Missing or misconfigured records don't just risk the spam folder — increasingly, they mean outright rejection. Since February 2024, Google and Yahoo require SPF, DKIM, and DMARC for any sender pushing more than 5,000 messages a day to their users, and both providers have signaled the bar keeps tightening for smaller senders too. Setting all three up correctly, once, is far less work than troubleshooting deliverability problems after the fact.

#Step 1: Add a dedicated sending subdomain

Rather than sending from your root domain directly, use a subdomain dedicated only to outbound marketing and transactional mail — for example mail.yourbrand.com or mg.yourbrand.com. This keeps your sending reputation isolated from anything else running on your root domain (your website, your regular business email) and makes it easy to reset if something ever goes wrong with that reputation.

1. Go to Settings > Email Services and open the Dedicated Domain and IP tab.
2. Click Add Domain.
3. Enter the subdomain you want to send from (not your root domain — pick something like mail or mg as the subdomain portion).
4. The platform generates the DNS records you'll need in the next step: typically an SPF TXT record, a DKIM TXT record, and supporting CNAME/MX records for the subdomain itself.

Warning: If your domain already has SPF or MX records pointing somewhere else (a previous email tool, a website builder), you may see a "domain already pointing to email server" error. Remove the conflicting records before adding new ones — DNS doesn't merge multiple SPF records gracefully.

#Step 2: Add the DNS records at your domain host

Log in to wherever your domain's DNS is managed — Cloudflare, GoDaddy, Namecheap, or similar — and add each record exactly as shown in your account's setup screen.

SPF record

• Type: TXT
• Host/Name: @ (root) or the subdomain, depending on what the setup screen specifies
• Value: the SPF string provided, typically starting with v=spf1

DKIM record

• Type: TXT
• Host/Name: the DKIM selector provided (a string unique to your account)
• Value: the DKIM public key provided — copy it exactly, including any surrounding quotes if your DNS host requires them

DMARC record

• Type: TXT
• Host/Name: _dmarc
• Value: start conservative — v=DMARC1; p=none; — while you confirm everything passes, then tighten later (see below)

Tip: DNS changes can take anywhere from a few minutes to 48 hours to fully propagate. If verification fails immediately after saving, wait and retry before assuming something's wrong.

#Step 3: Verify

Return to your account's Email Services settings and trigger verification. A green "Verified" status on the domain confirms the records were found and matched correctly.

To confirm authentication is actually passing end to end, not just that the records exist:

1. Send a test email from your new domain to a Gmail address you control.
2. Open the message in Gmail, click the three-dot menu next to Reply, and choose Show original.
3. Confirm SPF, DKIM, and DMARC all show PASS.

If any of the three shows FAIL, double-check the record's exact value against what your account's setup screen provided — a single missing character or extra space in a DKIM key is a common cause.

#Tightening your DMARC policy over time

Starting at p=none (monitor only, take no action on failures) is deliberate — it lets you confirm every legitimate sending source passes before you start blocking anything. Once you're confident:

1. Move to p=quarantine; pct=25 — a quarter of failing mail gets sent to spam as a test.
2. Increase the percentage gradually as you confirm nothing legitimate is getting caught.
3. Move to p=reject once you're fully confident — this is the goal state, where spoofed mail claiming to be from your domain is rejected outright rather than merely flagged.

Jumping straight to p=reject before you've verified every legitimate source is authenticated correctly can silently block your own mail, so don't skip the monitoring phase.

#Common problems

#What done looks like

Your dedicated sending domain shows "Verified" in Email Services, a test send to Gmail shows PASS on SPF, DKIM, and DMARC when you view the original message, and your DMARC record is at least at p=none (ideally further along the tightening path if you've been sending for a while).

#Related articles

• Email marketing overview
• Email deliverability best practices
• Troubleshoot email problems

#Frequently asked questions

#Can I use my root domain instead of a subdomain?

You can, but a subdomain is recommended. It isolates your marketing sending reputation from your regular business email and website, so a deliverability problem in one doesn't spill into the other.

#Do I need DMARC if I'm sending under 5,000 emails a day?

It's not strictly required at low volume, but it's still worth setting up. Beyond meeting the bulk-sender threshold if you ever cross it, DMARC protects your domain from being spoofed by phishing attempts and generally improves how mailbox providers score your legitimacy.

#What happens to email I've already sent if I change my sending domain later?

Nothing retroactive — past sends aren't affected. But a new domain starts with zero sending history, so expect a warm-up period (see the deliverability article) before it performs as well as an established domain.