MX records and email deliverability: SPF, DKIM and DMARC

Email deliverability feels like a dark art, but almost all of it comes down to a few DNS records doing their jobs correctly. Get MX, SPF, DKIM and DMARC right and your mail lands in the inbox. Get them wrong and it silently vanishes into spam folders — or never arrives. Here's how the pieces fit.

MX records: where incoming mail goes

An MX (Mail Exchange) record tells the world which servers accept email for your domain. When someone emails you@example.com, their server looks up the MX records for example.com and delivers there.

example.com.    MX    10    mail.example.com.
example.com.    MX    20    backup.example.com.

Two things to know:

• The number is a priority — lower is preferred. Mail tries priority 10 first, falling back to 20 only if the first is unreachable.
• MX records point to a hostname, not an IP, and that hostname needs its own A record. You also can't point an MX at a CNAME — use a real hostname.

Your MX records are completely independent of your website's A record, which is why you can host your site on your VPS and your email with a provider like Google Workspace or Fastmail at the same time.

The deliverability trio: SPF, DKIM, DMARC

Receiving your mail is one thing; getting *your outbound* mail trusted is another. Spammers forge sender addresses constantly, so mailbox providers won't trust a domain that hasn't proven which servers may send for it. Three TXT-based records do that proving.

SPF — who is allowed to send

SPF (Sender Policy Framework) is a TXT record listing the servers permitted to send mail as your domain:

example.com.    TXT    "v=spf1 include:_spf.google.com include:mail.example.com ~all"

• include: pulls in a provider's authorised servers.
• ~all means "anything else is suspicious (soft fail)"; -all means "reject anything else (hard fail)."

If you send from Google Workspace, your VPS, and a newsletter tool, all three must appear in SPF or their mail may be flagged. A common mistake is having more than one SPF record — you're only allowed one; merge them.

DKIM — a cryptographic signature

DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key; the matching public key lives in a TXT record at a selector subdomain:

selector._domainkey.example.com.    TXT    "v=DKIM1; k=rsa; p=MIGfMA0G..."

The receiver fetches the public key, verifies the signature, and confirms the message wasn't forged or altered in transit. Your mail provider generates the key and tells you the exact record to publish.

DMARC — the policy that ties it together

DMARC tells receivers what to do when a message fails SPF and DKIM, and where to send reports:

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

• p=none — monitor only (start here to see reports without affecting delivery).
• p=quarantine — send failing mail to spam.
• p=reject — refuse failing mail outright (the strongest, once you're confident).
• rua= — the address that receives aggregate reports, so you can see who's sending as your domain.

Best practice is to launch with p=none, read the reports for a couple of weeks to confirm all your legitimate senders pass, then tighten to quarantine and eventually reject.

PTR / reverse DNS: the often-forgotten one

If you send mail directly from your own server, receivers check the PTR record — reverse DNS mapping your sending IP back to a hostname. A missing or generic PTR is a fast track to the spam folder. This is set on the IP by whoever controls it. On a Nxeon VPS with a dedicated IP you can set reverse DNS for your mail hostname, which most residential and shared setups can't offer.

A deliverability checklist

1. MX records point to your mail host, with correct priorities.
2. One SPF record listing every service that sends for you, ending in ~all or -all.
3. DKIM published with the selector your provider gave you.
4. DMARC in place, starting at p=none and tightening over time.
5. PTR / reverse DNS set if you send directly from your server.
6. No duplicate SPF records and no CNAME on the MX target.

Miss any of the first four and a good share of your mail will struggle to reach inboxes.

Check your mail DNS now

Our free DNS lookup at /tools/dns-lookup shows your domain's live MX and TXT records — so you can confirm your MX priorities, read your SPF string, and verify DMARC is published, all in one place. Run it before and after any change to catch typos before they cost you deliverability.

Want full control of your mail stack, including reverse DNS on a dedicated IP? A Nxeon VPS lets you run your own mail server or point MX at a provider while keeping the site on the same box — full root, dedicated IP, your rules. See /vps.