Custom Domain DNS Setup Guide (MX, SPF, DKIM, DMARC)

To send and receive business emails using your custom domain (e.g., user@yourcompany.com), receiving email providers (such as Google Workspace, Microsoft 365, and Apple Mail) require cryptographic proof that your domain authorizes Nyota Mail to route and dispatch your messages.

This guide explains what each DNS record does under the hood, the exact record values to add to your domain registrar, and how to verify propagation to guarantee 100% inbox deliverability.

1. How Email Authentication Works Under the Hood

When an employee sends an email from your custom domain, the recipient’s mail server checks four DNS records before deciding whether to deliver the message to the Primary Inbox or flag it as Spam:

OUTBOUND EMAIL DISPATCHED (user@yourcompany.com)
                                      │
                                      ▼
               RECIPIENT INBOX CHECK (Gmail / Outlook / Apple)
                                      │
         ┌────────────────────────────┼────────────────────────────┐
         ▼                            ▼                            ▼
┌──────────────────┐        ┌──────────────────┐        ┌──────────────────┐
│    1. MX CHECK   │        │   2. SPF CHECK   │        │  3. DKIM CHECK   │
│ Does Nyota route │        │ Is Nyota server  │        │ Validates 2048b  │
│ mail for domain? │        │ IP authorized?   │        │ RSA signature.   │
└──────────────────┘        └──────────────────┘        └──────────────────┘
                                      │
                                      ▼
                            ┌──────────────────┐
                            │  4. DMARC POLICY │
                            │ Defines action:  │
                            │ quarantine/reject│
                            └──────────────────┘

2. The Required DNS Records Matrix

Add the following four records to your domain’s DNS provider (e.g., Cloudflare, Namecheap, GoDaddy, Safaricom Domains):

A. MX Records (Mail Exchange — Inbound Routing)

Directs all incoming email traffic sent to your domain into your Nyota Mail cluster:

(Note: If your DNS manager does not support @, leave the host field blank or enter yourcompany.com).

B. SPF Record (Sender Policy Framework — Anti-Spoofing)

Asserts that Nyota Mail IP addresses are authorized to dispatch outbound email on your behalf:

Critical Rule: You must have only ONE SPF record on your domain. If you already have an existing SPF record (e.g., for Mailchimp or Brevo), merge them by adding include:mxroute.com inside your existing record (e.g., v=spf1 include:brevo.com include:mxroute.com ~all). Having two separate SPF records causes all incoming mail servers to fail validation.

C. DKIM Record (DomainKeys Identified Mail — Cryptographic Signature)

Cryptographically signs your outbound email headers using a 2048-bit RSA key generated specifically for your domain:

To find your exact DKIM value, log in to mailadmin.nyotaimara.com/domains and click "View DNS Records" next to your domain.

D. DMARC Record (Delivery Enforcement & Alignment)

Instructs receiving servers how to handle messages that fail SPF or DKIM checks:

3. Step-by-Step: Adding DNS Records

1. Log in to the Nyota Mail Console.
2. Go to Domains in the sidebar and click "Add New Domain".
3. Enter your corporate domain name (e.g., yourcompany.com) and click "Register Domain".
4. Nyota will display your tailored DNS configuration table with your unique DKIM key.
5. In a new tab, open your domain registrar's DNS settings (e.g., Cloudflare DNS or GoDaddy DNS Manager).
6. Delete any old, conflicting MX records from legacy providers (such as old cPanel, Google Workspace, or Zoho MX records).
7. Create the two MX records, the SPF TXT record, the DKIM TXT record, and the DMARC TXT record.
8. Save changes.

4. Common Pitfalls & How to Troubleshoot

Pitfall A: "My domain status in mailadmin is stuck on 'Pending DNS Verification'."

• The Cause: DNS propagation latency. Depending on your domain registrar's Time-To-Live (TTL) setting, DNS updates take between 15 minutes and 24 hours to replicate globally.
• The Resolution:
• • Set your DNS record TTL to "Auto" or "300 seconds (5 minutes)" during initial setup.
  • Click the "Check DNS Records" button in mailadmin.nyotaimara.com/domains to force a real-time DNS lookup.

Pitfall B: "Outbound emails are landing in the recipient's Spam folder."

• The Cause: The DKIM TXT record was either not added or added under an incorrect host name (e.g., typing x._domainkey.yourdomain.com.yourdomain.com due to a DNS provider auto-appending the root domain).
• The Resolution:
• • In Cloudflare or Namecheap, enter only x._domainkey in the Name/Host field.
  • Verify your live DKIM record in your terminal:

dig txt x._domainkey.yourdomain.com +short

If this command returns your public key string, your DKIM record is live and working.

Related Support Guides & Links

• Understanding Flat Seats + Shared Storage Pooling
• Configuring Outlook, Apple Mail & Thunderbird (IMAP/SMTP)
• Zero-Downtime Email Migration Guide
• Direct Mail Administration Console