DNS Setup GuideCopy Anchor Link

Properly configured DNS records are essential for email deliverability. Without them, your emails are far more likely to land in spam or be rejected outright. This guide covers the three key authentication records (SPF, DKIM, DMARC) and the optional MX record for inbox users.

OverviewCopy Anchor Link

Email authentication works through DNS records that prove you authorized NorthRelay to send email on behalf of your domain. Receiving mail servers check these records to verify legitimacy.

SPF RecordCopy Anchor Link

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are authorized to send email for your domain.

What to AddCopy Anchor Link

Add a TXT record at the root of your domain:

How It WorksCopy Anchor Link

The include:_spf.north-pipe.ca directive tells receiving servers to look up NorthRelay's SPF record, which lists NorthRelay's sending IPs (IPv4 and IPv6), so you never need to update SPF when our infrastructure changes. The -all suffix means "reject email from any other source" — this is the strictest and most secure setting.

If You Already Have an SPF RecordCopy Anchor Link

A domain can only have one SPF TXT record. If you already send email through another provider, merge the records:

v=spf1 include:_spf.north-pipe.ca include:_spf.google.com -all

Do not create a second TXT record starting with v=spf1 — this will cause SPF to fail entirely.

Common MistakesCopy Anchor Link

• Using ~all (softfail) instead of -all (hardfail) — softfail is weaker and may not protect you
• Adding more than 10 DNS lookups in your SPF chain (SPF has a 10-lookup limit)
• Creating multiple SPF records on the same domain

Existing domains using include:north-pipe.ca remain supported. New setup instructions use include:_spf.north-pipe.ca. Publish only one SPF record.

DKIM RecordCopy Anchor Link

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email, allowing the recipient to verify the message was not altered in transit.

Configure your domainCopy Anchor Link

For a custom domain, publish the DKIM TXT record shown in Domains & senders at default._domainkey.yourdomain.com. Copy the full signing key from the dashboard. NorthRelay manages the signing infrastructure; you manage DNS for your custom domain. Managed NorthRelay domains are configured automatically.

To verify your domain:

1. Go to Dashboard → Domains
2. Click Add Domain and enter your domain name
3. Add the per-domain ownership TXT record at _northrelay.yourdomain.com, plus the SPF and DKIM TXT records shown in the dashboard
4. Click Verify
5. Once verified, DKIM signing is enabled automatically

Verifying DKIMCopy Anchor Link

After domain verification, confirm the DKIM record is published:

dig TXT default._domainkey.yourdomain.com

You should see a response containing a v=DKIM1; k=rsa; p=... value. If the record is missing, wait up to 48 hours for DNS propagation, then check again.

SubdomainsCopy Anchor Link

DKIM signing supports subdomains automatically. If you send from notifications@sub.yourdomain.com, the parent domain's DKIM key will sign the email (using the SubDomains=yes configuration on NorthRelay's signing infrastructure).

DMARC RecordCopy Anchor Link

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers how to handle emails that fail SPF or DKIM checks, and where to send aggregate reports.

What to AddCopy Anchor Link

Add a TXT record at _dmarc.yourdomain.com:

Policy OptionsCopy Anchor Link

We recommend starting with p=quarantine and moving to p=reject after monitoring reports for 2-4 weeks.

Full DMARC Record ExampleCopy Anchor Link

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; adkim=r; aspf=r; pct=100

MX Record (Inbox Users)Copy Anchor Link

If you are on the Pro tier or above and want to receive email through NorthRelay's inbox, add an MX record pointing to NorthRelay's mailbox server.

This routes inbound email for your domain to NorthRelay's mailbox servers, where it is accessible via the Dashboard inbox or IMAP/JMAP clients.

VerificationCopy Anchor Link

Using dig (Linux/macOS)Copy Anchor Link

# Check SPF
dig TXT yourdomain.com

# Check DKIM
dig TXT default._domainkey.yourdomain.com

# Check DMARC
dig TXT _dmarc.yourdomain.com

# Check MX
dig MX yourdomain.com

Using nslookup (Windows)Copy Anchor Link

# Check SPF
nslookup -type=TXT yourdomain.com

# Check DKIM
nslookup -type=TXT default._domainkey.yourdomain.com

# Check DMARC
nslookup -type=TXT _dmarc.yourdomain.com

# Check MX
nslookup -type=MX yourdomain.com

Using the DashboardCopy Anchor Link

Go to Dashboard → Domains, select your domain, and click Check DNS. The dashboard will verify all required records and report any issues.

DNS Provider ExamplesCopy Anchor Link

CloudflareCopy Anchor Link

1. Log in to Cloudflare and select your domain
2. Go to DNS → Records → Add Record
3. Set type to TXT, name to @, and paste the SPF value
4. Repeat for DMARC (name: _dmarc)
5. If using proxy (orange cloud), note that TXT records are never proxied

Amazon Route 53Copy Anchor Link

1. Open the Route 53 console and select your hosted zone
2. Click Create Record
3. Leave the record name blank for root, set type to TXT
4. Paste the SPF value in quotes: "v=spf1 include:_spf.north-pipe.ca -all"
5. Route 53 requires TXT values to be enclosed in double quotes

GoDaddyCopy Anchor Link

1. Go to My Products → DNS for your domain
2. Click Add under the Records section
3. Select type TXT, set host to @, and paste the SPF value
4. GoDaddy may take up to 48 hours to propagate changes

TroubleshootingCopy Anchor Link

DNS propagation delaysCopy Anchor Link

DNS changes can take up to 48 hours to propagate globally, though most providers update within 1-4 hours.

• Use dnschecker.org to check propagation status worldwide
• Lower your TTL to 300 (5 minutes) before making changes to speed up future updates

Conflicting SPF recordsCopy Anchor Link

If you have multiple TXT records starting with v=spf1, SPF validation will fail. Merge all include: directives into a single record.

"Too many DNS lookups" SPF errorCopy Anchor Link

SPF allows a maximum of 10 DNS lookups. Each include: directive counts as one lookup. If you exceed 10, consider:

• Removing providers you no longer use
• Using ip4: or ip6: directives instead of include: for static IPs
• Using an SPF flattening service

DKIM record not foundCopy Anchor Link

• Wait up to 48 hours after domain verification
• Confirm you verified the domain in Dashboard → Domains
• Check the exact record name: default._domainkey.yourdomain.com (not dkim._domainkey)

DMARC reports not arrivingCopy Anchor Link

• Verify the rua email address is correct and can receive email
• Some providers take 24-48 hours to start sending reports
• Check that the rua address domain has a DMARC report authorization record if it differs from the sending domain