Set up SPF, DKIM and DMARC for your domain
Why mailbox providers need your domain verified, what records to add, and how to tell when it has worked.
Domains in NevarMail represent the sending domains you use for email delivery. Proper domain configuration ensures high deliverability and protects your sender reputation.
Why domain verification matters
Email providers and receiving mail servers use DNS records to verify that you are authorized to send email from a domain. Without proper configuration, your emails are more likely to be flagged as spam or rejected entirely.
Three DNS record types matter. NevarMail fetches the DKIM and return-path records your provider needs (the return-path record is what makes SPF pass, so there is no SPF record to add); DMARC is a record you add yourself:
| Record | Purpose |
|---|---|
| SPF | Specifies which mail servers are authorized to send email for your domain |
| DKIM | Adds a cryptographic signature to verify message integrity |
| DMARC | Tells receiving servers what to do when SPF or DKIM checks fail. NevarMail does not generate it: once DKIM verifies, add a TXT record at _dmarc.yourdomain.com with a value like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, and tighten p= to quarantine or reject after the reports look clean |
A name can carry only one v=DMARC1 record. If _dmarc.yourdomain.com already exists, edit it rather than adding a second: receivers ignore the name when it has two.
Add a domain
Navigate to the Domains page in the dashboard and add your sending domain. NevarMail will:
- Register the domain with your connected provider
- Fetch the exact DNS records that provider requires for this domain, live from the provider's own API
- Monitor verification status automatically
DNS record setup
After adding a domain, NevarMail shows you the exact DNS records to add to your domain's DNS configuration. These records are retrieved live from your provider at add-domain time -- NevarMail does not maintain its own static list of per-provider record requirements, since a provider can change what it requires. The records typically include CNAME entries for DKIM authentication and for the return-path (bounce) host your provider uses for SPF, but the specifics come from the provider's response.
Why there is no SPF record to add on your domain
SPF is checked against the envelope sender (the return-path), not the From address you see. Your provider sends from its own return-path subdomain, set up by the CNAME records above, and SPF passes there. DMARC then passes through DKIM, which is signed for your domain. An SPF TXT record on your From domain does nothing for mail sent through NevarMail. If your domain already has an SPF record for other mail (your office mailbox, for example), leave it alone, and never add a second v=spf1 record: two make SPF fail for everything.
Verification status
After adding DNS records, NevarMail periodically checks verification status. Domain states include:
| Status | Description |
|---|---|
pending | DNS records have been generated but not yet verified |
verified | All DNS records are correctly configured |
failed | DNS verification failed (records may be missing or incorrect) |
Best practices
- Verify before sending -- Always wait for domain verification to complete before sending production emails
- Use a subdomain -- Consider using a subdomain like
mail.yourdomain.comfor transactional email to isolate your sending reputation - Monitor DNS -- DNS changes can take up to 48 hours to propagate, though most complete within minutes
- One domain per use case -- Separate marketing and transactional email onto different subdomains for better deliverability control
The default use case
Every project starts with a default use case. Here is what it is for, why its emails carry the unsubscribe footer, and what happens to a send that names no use case.
Send a transactional email
Send a one-off email, send from a template, or schedule one for later — with the request and response shapes you will actually get back.