Skip to content
SendPoint / Education
Email authentication

Publish email DNS records

Translate provider-issued records into Cloudflare, Route 53, GoDaddy or BIND.

SendPoint referenceUpdated 2 min read

Use the values issued for your account

Collect the record owner, type, value and TTL from the sending platform. Never substitute a public key, verification token or CNAME target from another account. Back up the affected records and identify the authoritative DNS provider before editing.

Choose your DNS provider

Cloudflare

Create the record in the authoritative zone using the required TXT, CNAME or MX type. Mail-serving A and AAAA records must use DNS-only resolution. Follow the ESP’s DNS-only instructions for authentication CNAMEs; web proxying does not authenticate email.

AWS Route 53

Use the public hosted zone that is delegated for the domain. TXT data uses quoted strings; long TXT data can be split into adjacent strings within one record value. Do not turn chunks of one DKIM key into separate TXT records.

GoDaddy

Add the required type in the domain’s DNS management. Check whether the Name field expects a relative label and automatically appends the zone name. Paste the provider-issued value, then inspect the complete published owner name.

BIND

Edit the authoritative zone through your normal deployment process. Distinguish fully qualified names, which end with a dot in a zone file, from names relative to the zone origin. Increment the serial when required and validate before a controlled reload.

Bash
read -r -p "Actual zone name: " zone_name
read -r -p "Absolute path to the edited zone file: " zone_file
named-checkzone "$zone_name" "$zone_file"

Verify publication and behavior

  1. Check the exact owner name and record type against the ESP’s instruction. Avoid duplicating an existing SPF policy.
  2. Query the authoritative nameserver and then the recursive resolver used by your validation path.
  3. Complete the sending platform’s verification and inspect a real newly sent message for authentication results.

See dig and nslookup commands and a minimal DMARC observation policy. Keep the provider-issued values with the change record.

Sources