MailMooseDomains
DNS records explained
Understand the records in your domain setup checklist.
Always copy the exact records shown for your domain. The checklist depends on the configured receiving and sending providers; another domain’s values will not work.
| Record | Purpose | Watch for |
|---|---|---|
| TXT ownership / DKIM | Ownership or a signing key | Preserve records used by other services. |
| CNAME DKIM | Provider signing key | Use the exact selector and target; turn off DNS proxying. |
| Return path / SPF | Provider bounce or sending authorization | Follow the shown hostname; it may be a subdomain. |
| DMARC TXT | Authentication policy | Preserve an existing policy unless deliberately changing it. |
| MX | Incoming mail routing | Switch after all required inboxes are prepared. |
You may see several receiving-identity DKIM records and separate sending-provider records. Receiving and sending verify independently.
Names and values
Some DNS hosts add your domain suffix automatically. For selector._domainkey.example.com, the host may expect only selector._domainkey. Avoid creating selector._domainkey.example.com.example.com.
Copy values exactly. A host may display a trailing dot or quotes around TXT values; do not add extra text yourself.
Keep existing email working
Adding an unused DKIM selector normally does not move incoming mail. Replacing an existing selector, return path or DMARC policy can affect another service. Follow whether the checklist says add, edit or replace.
Do not publish multiple SPF records at one hostname. Merge authorized services correctly instead of blindly overwriting existing SPF. Receiving through SES alone does not require new root SPF authorization.
Save old MX for rollback. Move incoming mail explains when to switch.
Why checks take time
DNS caches retain records until their TTL expires; providers may verify separately. There is no universal one-hour guarantee. Recheck MailMoose rather than assuming a record has propagated everywhere.
Last updated 2026-10-20