Adding a domain
Add a domain, publish the records we generate, and verification starts polling automatically. We read your existing DNS first and adapt — the wizard will never tell you to publish something that breaks the email you already have, and it can physically not generate an instruction to add a second SPF record.
| Kind | Type | Host | Required |
|---|---|---|---|
| ownership | TXT | _mailhaap.{domain} | Yes |
| dkim (×3) | CNAME | {selector}._domainkey.{domain} | Yes |
| spf | TXT | {domain} | Yes — merged, never a second record |
| mail_from_mx | MX | bounce.{domain} | Yes for sending |
| mail_from_spf | TXT | bounce.{domain} | Yes for sending |
| dmarc | TXT | _dmarc.{domain} | Strongly recommended |
| tracking | CNAME | track.{domain} | Optional, strongly advised |
| mx (×2) | MX | {domain} | Only if you host mailboxes with us |
| autodiscover | CNAME | autodiscover.{domain} | Mailbox only |
| tls_rpt | TXT | _smtp._tls.{domain} | Optional |
Why the custom MAIL FROM subdomain is not optional
The bounce.{domain} records give you a Return-Path aligned with your own domain. Without them the Return-Path belongs to the sending provider, SPF alignment under DMARC fails, and you can never move to p=reject. Two records, permanent benefit.
How verification works
Every check queries four sources in parallel and requires agreement from at least two: Cloudflare, Google and Quad9 over DNS-over-HTTPS, plus the domain's own authoritative nameservers found via an NS lookup. Querying the authoritative server is what makes propagation messaging accurate — it lets us say “the record exists, your resolver has not caught up” instead of “missing”.
- Every 10 seconds for the first 5 minutes
- Every 60 seconds for the next 55 minutes
- Every 15 minutes for the next 24 hours
- Hourly for 72 hours, after which the domain is marked failed
Proxied DKIM records break DKIM