Before you start
- A domain you own, and a login for the place its DNS is managed (your DNS host). That is usually your registrar or Cloudflare. Run
dig NS yourdomain.com +short, or any “NS lookup” site, to see which. - A decision on where mail for the domain should arrive. A domain has one set of MX records, so if mail already reaches another provider, adding new MX records moves it.
- About thirty minutes. Most DNS changes are visible within minutes; old cached answers can take up to 48 hours to expire.
The records, and what each does
These are the records Nexmail asks for when it sends and receives through Resend, shown for example.com. Always copy the exact values from your own setup: the region and the DKIM key differ for every account.
| Type | Host | Example value | What it does |
|---|---|---|---|
| MX | send | feedback-smtp.us-east-1.amazonses.com (priority 10) | Lets Resend collect bounces for the mail you send. It only covers the send subdomain, so your own mail is untouched. |
| TXT | send | v=spf1 include:amazonses.com ~all | SPF. Tells other mail servers that Resend is allowed to send for you. |
| TXT | resend._domainkey | p=MIGfMA0GCSqGSIb3… (a long key) | DKIM. A public key that proves each message really came from your domain and was not changed on the way. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@example.com | Tells receivers what to do with mail that fails the checks. p=none means report only, block nothing, which is the safe start. |
| MX | @ | inbound-smtp.us-east-1.amazonaws.com (priority 10) | Sends mail for your domain to Nexmail through Resend. Add it only if Nexmail should receive your mail: it replaces wherever your mail goes today. |
Sending through Brevo instead? You publish Brevo’s SPF include and the DKIM records Brevo gives you under its domain settings, and the same DMARC record. Nexmail lists whichever set your provider needs.
Receiving: the MX record
An MX record at @ tells the world which server accepts mail for your domain. Point it at your receiving service and remove the old MX records, or mail is split between two places. If you are not ready to move your mail, you can receive through a Gmail or Google Workspace account instead and add no MX record at all; see Connect Gmail.
Sending: SPF
SPF is a TXT record that lists the services allowed to send for a domain. A host can have only one record starting with v=spf1; if one exists, merge the includes into it rather than adding a second, or both fail.
Sending: DKIM
DKIM is a public key published at a named selector, such as resend._domainkey. Your provider signs each message with the matching private key, and receivers use the record to check the signature. Copy the key in full; a truncated key is the most common reason DKIM fails.
Sending: DMARC
DMARC, a TXT record at _dmarc, tells receivers what to do when a message fails SPF and DKIM, and where to send reports. Start with p=none, which only reports. Nexmail files the daily reports away under their own label so they do not fill the inbox.
The mistakes that stop a domain verifying
- The full name in the host field. Most DNS hosts add your domain for you, so
send.example.combecomessend.example.com.example.com. Type onlysend,_dmarcor@. - The Cloudflare proxy left on. Mail records must be DNS only, the grey cloud. See Cloudflare.
- MX records in the wrong place on Namecheap. They go under Mail Settings, set to Custom MX. See Namecheap.
- Deleting and re-adding a record that looks right. That only restarts the wait.
Check that it works
In Nexmail, Check DNS looks up every record through public resolvers and marks each one found. Then send a test from your domain to an outside address, such as a personal Gmail, and reply to it. In Gmail, Show original on the received message shows SPF: PASS, DKIM: PASS and DMARC: PASS when everything lines up.
How to set it up
- Create a workspace. Sign up for free and open Get started.
- Add your domain. Nexmail asks your provider for the exact records your domain needs and lists them.
- Publish the records. Paste a Cloudflare, Vercel or DigitalOcean API token and Nexmail adds them, or copy them into your DNS host by hand using the steps for every host.
- Check DNS. Click Check DNS. Nexmail keeps checking until every record is found.
- Send a test. Send to an outside address, reply, and confirm SPF, DKIM and DMARC pass.
Questions
How long does it take for DNS records to work?
Usually minutes, sometimes an hour. Old cached answers can last up to 48 hours. Nexmail keeps checking on its own.
Will adding these records break my existing email?
The sending records (SPF, DKIM, DMARC) sit beside what you have, as long as you merge SPF into one record. The receiving MX record does move where your mail goes, so add it only when you are ready.
Do I have to move my DNS to Cloudflare?
No. Any DNS host works. If yours is not Cloudflare, Vercel or DigitalOcean, Nexmail can move your DNS to Cloudflare for free so later changes are one click, but adding the records by hand is fine.
Can I use a subdomain for email?
Yes. Records for a subdomain such as help.yourcompany.com are separate from the main domain, which is a common way to keep shared or bulk mail apart from personal mailboxes.
Read next
- SPF, DKIM and DMARC explained — What SPF, DKIM and DMARC do, how they work together, what a good record looks like, and the mistakes that send your mail to spam. In plain language.
- Connect your domain to Nexmail — The DNS records Nexmail needs to send and receive email at your domain through Resend, what each one does, how to find your DNS host, and the common mistakes that stop a domain verifying.
- Free business email on your own domain — How to get free team email at your own domain: addresses for everyone, a shared inbox and Slack routing, sending through your own Resend or Brevo account.