DNS records & email authentication

Sending mail on your own domain takes more than creating a mailbox. Receiving providers like Gmail, Outlook, and Yahoo check that your domain has authorized NevTan Mail to send on its behalf. Until those DNS records are published and verified, your messages can be rejected or filed as spam — even though NevTan Mail accepted and sent them.

Why this matters

Email was not built with sender verification, so providers added their own. Today a receiving server asks three questions about every message:

1. Is the server that sent this allowed to send for this domain? — answered by SPF.
2. Has the message been tampered with, and does it carry a valid signature from the domain? — answered by DKIM.
3. If those checks fail, what does the domain owner want done about it? — answered by DMARC.

A domain with none of these is unauthenticated. Gmail and Yahoo now reject or quarantine unauthenticated mail from domains that send to their users, so this is not optional hardening — it is a requirement for your mail to arrive.

The records you'll add

Your domain needs seven records. Four are required: until they are published, mail sent to your domain has nowhere to go, and mail you send can be refused as unauthenticated. Your domain verifies as soon as those four are found.

The remaining three are not needed to verify. They let Outlook, Thunderbird and the mail app on a phone configure themselves from an address and password, instead of your team typing server names and ports by hand.

Six of the seven values are identical for every NevTan Mail domain, so you can take them from the table below and add them at your DNS provider now. DKIM is the exception — its key is generated for your domain alone, so copy that value from Admin → Domain → DNS.

The last three records all do the same job, but their labels depend on your plan:

• What they are for — they let Outlook, Thunderbird and the mail app on a phone set themselves up from an address and password, instead of somebody typing server names and port numbers by hand.
• If your plan includes mail-app access, the DNS screen groups them under Needed for mail apps — your plan includes them, and badges each one Needed for mail apps.
• If it does not, they appear instead as Recommended — add these when you can.
• Either way they never hold up verification. Only the four required records decide that.

Finding your record values

Every value you need is generated for your domain and listed on one screen inside NevTan Mail. You never have to work them out yourself, and you should never take them from anywhere else.

1. Sign in as an admin: Record values are only visible to admins of the domain. If you can't see the Admin area, ask whoever set the domain up.
2. Open Admin → Domain: The domain table lists every domain on your account, with its mailbox usage, storage, and status.
3. Choose DNS on your domain's row: This opens the DNS records screen for that specific domain. Each domain has its own values — if you run more than one, don't mix them up.
4. Read each record card: Each record shows its Type (MX, TXT, or CNAME), the Host / Name to create, the Value to paste, and a badge saying Verified, Not found yet, Fix needed, or — for a record that is not one of the four required — Needed for mail apps or Recommended, depending on your plan.
5. Copy each value exactly: Use the Copy button next to the value and paste it. Don't retype it — DKIM values in particular are long, and a single altered character makes the record invalid.
6. Keep the screen open while you work: Add the records at your DNS provider in another tab. The screen re-checks every 30 seconds, so you can watch each row turn from Not found yet to Verified.
7. Or send them to whoever manages your DNS: If a developer or IT person looks after your domain, enter their address under Send to my developer. They get every value and the steps for your DNS provider, and their replies come to you.

MX — receiving mail

An MX (Mail Exchange) record tells the internet which servers accept mail for your domain. Without it, mail sent to your addresses never reaches NevTan Mail.

• MX records carry a priority number — lower numbers are tried first. Enter the priority exactly as shown.
• Remove or disable MX records pointing at a previous mail provider. Leaving them in place can send your mail to the old provider.
• MX affects incoming mail only. It has no effect on whether your outgoing mail is accepted.

SPF — who may send

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send mail using your domain. When a receiver gets a message claiming to be from you, it reads your SPF record and checks whether the sending server is on the list. If not, the message fails SPF.

An SPF record is a single line that looks broadly like this:

v=spf1  <authorized senders>  ~all

• v=spf1 — marks it as an SPF record.
• The middle lists who may send — this is the part NevTan Mail fills in for you.
• ~all or -all — how to treat everyone else (soft fail or hard fail).

DKIM — signing your mail

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The matching public key is published in your DNS, letting receivers confirm the message genuinely came from your domain and wasn't altered in transit.

DKIM is published on a selector — a subdomain-style prefix that lets a domain hold several keys at once. The record name therefore looks like a longer hostname rather than a bare domain.

• The value is unique to your domain and is the longest of the records — copy it in full.
• Some DNS providers automatically append your domain to the record name. If so, enter only the prefix, not the whole hostname, or you'll end up with it duplicated.
• Don't add line breaks or spaces when pasting. A broken key fails silently — mail sends, but signatures don't validate.

If you hit that, the DNS screen gives you the form those providers want:

• Open Admin → Domain → DNS and find the DKIM record.
• Take the split version of the value. It is the same key, broken into quoted pieces of 255 characters or fewer, which DNS joins back together when it is read.
• Paste the whole thing, quotes included, into the one TXT record. It is still a single record — never split a DKIM key across two.

DMARC — the policy

DMARC ties SPF and DKIM together. It tells receivers what to do when a message claiming to be from your domain fails those checks, and where to send reports about it.

A common approach is to start at p=none, confirm from the reports that your legitimate mail passes, then tighten to quarantine and eventually reject.

Publishing the records

1. Open your DNS records: Go to Admin → Domain, find your domain, and choose DNS.
2. Sign in to your DNS provider: This is wherever your domain is managed — for example Cloudflare, GoDaddy, Namecheap, or Route 53. It is often not the same company as your website host.
3. Add each record: Create a record for each row, matching the Type, Host / Name, and Value exactly. Copy and paste rather than retyping — a single wrong character invalidates the record.
4. Save and wait: Save at your provider. DNS changes need time to spread across the internet before NevTan Mail can see them.
5. Check the state: Return to the DNS screen and confirm each record shows Verified.

Verifying them

The DNS screen shows every record with a status badge and a progress bar across the top, so you can see at a glance what NevTan Mail can and can't find:

The badge on each record tells you where you stand:

• Verified — the record is published and matches. Nothing more to do.
• Not found yet — NevTan Mail can't see the record yet. Either it hasn't propagated, or the value doesn't match; the card shows what is currently published, or a hint, to help you spot the difference.
• Needed for mail apps — a mail-app record that isn't published yet, on a plan that includes mail-app access. Outlook, Thunderbird and phone apps can't set themselves up until it is, though it never holds up verification.
• Recommended — the same records on a plan without mail-app access. Worth adding, and likewise never holds up verification.
• Fix needed — the record is there, but something else on your domain stops it working: another mail provider's MX record at the same or a lower priority number, or a second SPF record. The note on the card says which.

Alongside the records, the domain itself shows a status in the domain table: Finish setup until the four required records — MX, SPF, DKIM and DMARC — are in place, then Verified.

Troubleshooting delivery

Mail sends, but Gmail or Outlook rejects it

This is the classic symptom of missing or invalid authentication: outgoing mail is accepted by NevTan Mail, then bounced by the recipient's provider with a message about the domain not being authenticated. Work through this in order:

1. Open Admin → Domain → DNS and check whether SPF and DKIM both report as correct. If either is pending, that is almost certainly the cause.
2. Confirm you have only one SPF record on the domain.
3. Check the DKIM value was pasted in full, with no line breaks, spaces, or truncation.
4. Confirm the record names are right — particularly whether your provider appends the domain for you.
5. Wait for propagation and check again before making further changes.

Read the bounce message itself where you can. Providers usually name the failing check directly, which tells you which record to look at.

Mail arrives, but lands in spam

• Confirm SPF and DKIM both report correct — passing authentication is the single biggest factor.
• Add DMARC if you haven't. A domain with no DMARC record is treated with more suspicion.
• New domains have no sending reputation. Build up volume gradually rather than sending a large batch on day one.

Mail isn't arriving at all

• Check the MX records report as correct — incoming mail depends on them.
• Make sure no MX records for a previous provider are still published.
• Confirm the mailbox exists and is Active — see the mailbox notes in Create & manage mailboxes.

Still stuck after the records report as correct? Email info@nevtan.com with your domain name and the full text of a bounce message, and we can look at it with you. DNS problems are often quicker to sort over chat: signed-in admins have a WhatsApp button in the bottom-right corner of every screen.