Set up your domain's email DNS so every email is delivered (SPF, DKIM, DMARC, MX)

Why these records are required

Gmail, Outlook and Yahoo only accept email that proves it really comes from your domain. Our servers therefore only send email for domains that have SPF and DKIM set up for Cloud Ninza. Until both records are found, email from that domain is refused with the message "Email from yourdomain.com is not authenticated yet". Nothing is lost on your website — once the records are in place, sending works again within the hour.

This protects your domain from being forged and keeps our sending IPs trusted, so everyone's email reaches the inbox. Domains that never send email from our servers do not need these records.

Where to find your exact values

In your dashboard open Domains → Email from this website. It shows the SPF, DKIM and DMARC values for that domain with Copy buttons and a live Found / Missing check. Your DKIM key is unique to your domain, so always copy it from there.

1. SPF — one TXT record at @ (the domain itself)

• No other email service (or mailboxes with us): v=spf1 a mx include:spf.clients.cloudninza.com ~all
• Google Workspace for mailboxes: v=spf1 include:_spf.google.com include:spf.clients.cloudninza.com ~all
• Microsoft 365: v=spf1 include:spf.protection.outlook.com include:spf.clients.cloudninza.com ~all
• Zoho Mail: v=spf1 include:zoho.com include:spf.clients.cloudninza.com ~all
• Already have an SPF record? Edit it and add include:spf.clients.cloudninza.com before the ~all or -all. A domain must have only one SPF record — two records break both.

2. DKIM — one TXT record named mail._domainkey

Type TXT, name mail._domainkey (your DNS provider adds your domain after it), value: the long v=DKIM1; k=rsa; p=… text copied from Domains → Email from this website. It does not replace a Google or Microsoft DKIM key — those use other names (google._domainkey, selector1._domainkey), so keep both.

3. DMARC — one TXT record named _dmarc (recommended)

Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com to receive reports. After a few weeks with no problems, change p=none to p=quarantine. Gmail and Yahoo require DMARC for anyone sending more than a few thousand emails a day.

4. MX and mail records — only if your mailboxes are with us

• MX at @ → mail.yourdomain.com, priority 10
• A record mail → our server IP shown on the Email page, and A record webmail → the same IP
• Using Google Workspace, Microsoft 365, Zoho or GoDaddy for mailboxes? Do not change MX — only add SPF and DKIM above, so your website can send while mail keeps arriving where it does today.

Cloudflare

• DNS → Add record → Type TXT. For SPF use Name @; for DKIM Name mail._domainkey; for DMARC Name _dmarc.
• Records mail and webmail must be DNS only (grey cloud), never Proxied — Cloudflare cannot carry email.
• Changes are usually live within 5 minutes.

GoDaddy, Hostinger and other DNS hosts

• GoDaddy: My Products → your domain → DNS → Add New Record → TXT. Host @ for SPF, mail._domainkey for DKIM, _dmarc for DMARC.
• Hostinger: Domains → your domain → DNS / Nameservers → Add record → TXT, same names.
• Most hosts add the domain to the name automatically — type mail._domainkey, not mail._domainkey.yourdomain.com, unless the host asks for the full name.
• Changes take from a few minutes to a few hours, depending on the host.

Check it worked

Back in Domains → Email from this website, SPF and DKIM should show Found. Our servers re-check every domain hourly, so sending starts on its own within the hour. To test, send yourself a message from your website (a contact form or "lost password") to a Gmail address, open it, choose Show original and look for SPF: PASS and DKIM: PASS.

Common mistakes

• Two SPF records (for example one from an old host and a new one) — merge them into one.
• Too many includes — SPF allows at most 10 DNS lookups; remove services you no longer use.
• Quotes or line breaks added around the DKIM value by the DNS host — paste it exactly as copied.
• Your website sends "from" a different domain (e.g. a Gmail address in the contact form plugin) — set the plugin's From address to an address on your own domain.
• Sending to old or bought mailing lists — addresses that bounce are not mailed again for 30 days, and heavy bouncing pauses sending.

Limits and spam protection

Every project also has hourly and daily sending limits and an automatic spam check — see the guide Email sending limits and spam protection (below, under Related guides). Bulk newsletters should use a dedicated email marketing service.