Understanding Automatic DNS Setup
Mail only reaches your domain when its DNS says so. You can publish those records yourself, or, on a connected Cloudflare or Namecheap account, let AtrioMail write them into the zone for you.
What DNS does for email
DNS is the address book of the internet. For email, a domain needs:
- MX records so other servers know where to deliver your incoming mail
- SPF record so receivers know which servers may send for your domain
- DKIM key so your outgoing mail is signed
- DMARC record so receivers know what to do with mail that fails those checks
- Amazon SES records so your outgoing mail is verified for your own domain
Where automatic DNS works
Automatic mail DNS, including the DKIM key, is built for Cloudflare and Namecheap. If your domain is on any other DNS provider or control panel, check with us before relying on it, and publish the records from the DNS Setup dialog in the meantime.
On Route 53 and DNSimple, add the records from the DNS Setup dialog.
The order matters
The domain has to exist in the connected DNS account before you add it here:
- Go to Tools → Integrations and add your DNS provider
- Use Test Connection to check the credentials
- Use Sync Domains to import the provider's domain list
- Go to Email Domains and use Add Domain
Do it in the other order and the domain shows DNS Automation Pending, which means the records have to be added by hand.
Writing the MX record moves your mail
As soon as the domain clears its automated security check, the MX record is written, and from that moment new mail for the domain arrives here instead of at your old provider. Add the domain when you are ready to switch, not before. Create the mailboxes and move the existing mail first if you can.
What gets written
On a connected Cloudflare or Namecheap account, AtrioMail can write the MX, SPF and DMARC records, the autodiscover and autoconfig records, and the domain's DKIM key. If the zone already has an SPF or DMARC record, that record is left in place instead of adding a second one.
The Amazon SES records are shown in the DNS Setup dialog once Amazon has issued them. Add those yourself, with the copy buttons next to each value.
If DNS is not connected
Every domain has a DNS Setup dialog in Email Domains listing exactly what to publish: MX, SPF, DMARC, and the DKIM key and Amazon SES records once they have been generated. Each value has a copy button, so you can paste them straight into your DNS host.
Checking the result
- The refresh icon (circular arrows) on the domain's row on the domain re-checks the live records on demand
- Tools → DNS Checker compares a domain against its exact expected values, including the DKIM key and the Amazon SES records, and prints the change to make for anything missing or wrong
- A record you have just changed can take up to 48 hours to be seen everywhere, though most changes show up sooner
If automatic setup did not run
Check the following:
- The domain exists in the connected DNS account, and the provider was connected and synced before the domain was added here
- The domain is using that provider's nameservers
- The provider credentials still work (Test Connection on the integration)
- The domain has passed its security check
If it still does not work, publish the records from the DNS Setup dialog and contact support through the live chat in the control panel. Support is available during business hours.
Common questions
Which records do you touch? Only the mail records listed above, in the zone you connected.
Can I change DNS providers later? Yes. DNS records are standard and portable. You can move the domain to another provider, or manage the records by hand at any time.
What if the domain already has mail records? On Cloudflare and Namecheap an existing SPF or DMARC record is left alone. Records from a previous mail provider, such as its MX entries or an old DKIM key, need to be removed by you once your mailboxes are ready, otherwise part of your mail keeps going to the old system. The DNS Checker lists what is still in the way.
How long does DNS propagation take? Usually well under an hour, sometimes up to 48 hours worldwide. See DNS Propagation Explained.