---
title: Custom Domain Email Setup: Google Workspace, Microsoft 365, Zoho, Fastmail, iCloud
description: Step by step, end to end: the verification, MX, SPF, DKIM and DMARC records Google Workspace, Microsoft 365, Zoho Mail, Fastmail and iCloud Mail ask for, how to add them on Nymwell, how to switch providers without losing mail, and how to check that it all passes.
updated: 2026-11-01
---

# Set up email on your own domain, end to end

This guide is for anyone who has a domain and wants addresses like `you@example.com` on Google Workspace, Microsoft 365, Zoho Mail, Fastmail or iCloud Mail. It takes you from an empty domain, or one with an old mail provider, to mail that arrives and passes SPF, DKIM and DMARC checks. Every value and wait time comes from the provider's own documentation, checked on 2026-11-01.

- **Order matters.** Prove you own the domain, create the mailboxes, then switch MX. After that add SPF, then DKIM, and DMARC last. Microsoft asks for users before MX so nothing bounces [1], and Google asks you to wait 48 hours after SPF and DKIM before turning on DMARC [2].
- **Keep one SPF record and remove the old provider's MX.** Two SPF records make SPF fail outright [3]. MX records left over from the previous provider can keep sending mail there [4][5].
- **Copy account-specific values from the provider.** Microsoft's MX and DKIM targets, Zoho's data centre hosts and every DKIM key belong to your account. Where this guide writes "the value shown in your admin console", copy that exact value.
- **Finish with a real test.** Send a message to an address at another provider and read its `Authentication-Results` header: you want `spf=pass`, `dkim=pass` and `dmarc=pass` [6].

## Which records does each provider ask for?

| Provider | Records to add |
| --- | --- |
| Google Workspace | **MX** `smtp.google.com`, priority 1 · **SPF** `v=spf1 include:_spf.google.com ~all` · **DKIM** TXT at `google._domainkey`, key from the Admin console · **Ownership** TXT `google-site-verification=…` |
| Microsoft 365 | **MX** the value shown in your admin center, priority 0 · **SPF** `v=spf1 include:spf.protection.outlook.com -all` · **DKIM** CNAMEs at `selector1._domainkey` and `selector2._domainkey`, values shown in your admin center · **Ownership** TXT shown in your admin center |
| Zoho Mail | **MX** `mx.zoho.com` 10, `mx2.zoho.com` 20, `mx3.zoho.com` 50 · **SPF** `v=spf1 include:zohomail.com -all` · **DKIM** TXT at `<selector>._domainkey`, key from the Admin Console · **Ownership** TXT `zoho-verification=zb….zmverify.zoho.com`, or a CNAME |
| Fastmail | **MX** `in1-smtp.messagingengine.com` 10, `in2-smtp.messagingengine.com` 20 · **SPF** `v=spf1 include:spf.messagingengine.com ?all` · **DKIM** CNAMEs at `fm1`, `fm2` and `fm3._domainkey` to `fm1.<domain>.dkim.fmhosted.com` and so on · **Ownership** — |
| iCloud Mail | **MX** `mx01.mail.icloud.com` and `mx02.mail.icloud.com`, both 10 · **SPF** `v=spf1 include:icloud.com ~all` · **DKIM** CNAME at `sig1._domainkey` to `sig1.dkim.<domain>.at.icloudmailadmin.com` · **Ownership** TXT shown on the setup page |

Checked against each provider's documentation on 2026-11-01. `<domain>` is your domain and `<selector>` is the name you choose in Zoho. "—" means the provider asks for no separate record: Fastmail shows the domain's status on its **Domains** screen. The Zoho MX hosts are for its `.com` data centre. DMARC is the same for every provider and has its own section below.

## Before you start

- **Admin access at the mail provider.** Google needs the Domain settings administrator privilege to verify a domain and a super administrator for DKIM [7][8]. Microsoft needs a Domain Name Administrator [9].
- **Access to the domain's DNS.** On Nymwell, owners and admins save records at once; other members' changes wait in **Approvals**.
- **Where the DNS lives.** The records below take effect only where the domain's nameservers point. If the domain uses Nymwell's nameservers, add them on Nymwell; if its DNS is hosted elsewhere, for example on Cloudflare, add them there.
- **If you're moving from another provider,** list every address that receives mail today and read [the switching section](#how-do-i-switch-from-my-old-email-provider-without-losing-mail) before you change MX.

## How do I add a record on Nymwell?

Open the domain in the console and go to its **DNS** tab. You have three ways in:

- **What do you want to connect?** → **Set up email** applies a preset for Google Workspace, Microsoft 365 or Zoho Mail, a DMARC record, or the no-email records. Nymwell lists what it will add and asks you to confirm, and **Undo last setup** takes it back.
- **Prove you own it** takes a verification TXT value: leave the host as `@` and paste the value.
- **Edit records** opens the full records list. **Add a record** shows a form with these fields:

| Field | What to enter |
| --- | --- |
| Type | `MX`, `TXT` or `CNAME` |
| Name | `@` for the domain itself; otherwise only the part before your domain, such as `_dmarc`, `google._domainkey` or `autodiscover` |
| Value | The value exactly as the provider shows it |
| TTL | 300, 3600 or 86400 seconds. 3600 suits most mail records; use 300 while you're switching providers |
| Priority (MX, SRV) | The MX priority, such as `1` or `10`; leave it empty for TXT and CNAME |

What each preset adds:

| Preset | Records it adds |
| --- | --- |
| Google Workspace | MX `@` `smtp.google.com` priority 1; TXT `@` `v=spf1 include:_spf.google.com ~all` |
| Microsoft 365 | MX `@` `<your-domain-with-dashes>.mail.protection.outlook.com` priority 0; TXT `@` `v=spf1 include:spf.protection.outlook.com -all`; CNAME `autodiscover` `autodiscover.outlook.com` |
| Zoho Mail (zoho.com accounts) | MX `@` `mx.zoho.com` 10, `mx2.zoho.com` 20, `mx3.zoho.com` 50; TXT `@` `v=spf1 include:zohomail.com ~all` |
| DMARC (watch first) | TXT `_dmarc` `v=DMARC1; p=none; rua=mailto:dmarc@<domain>`, or the report address you type in |
| No email (stop spoofing) | TXT `@` `v=spf1 -all`; TXT `_dmarc` `v=DMARC1; p=reject` |

A preset only adds records. It skips ones that are already there, and it never adds a second SPF or DMARC record. If the domain already has one, the console tells you, and you merge the new `include:` into the existing record. A preset doesn't remove the previous provider's MX records, and it doesn't add DKIM, because every key is made for your account. Fastmail and iCloud Mail have no preset, so add their records with **Add a record**.

If your provider's admin console shows values that differ from a preset's, add the console's values yourself instead. The Zoho preset is for accounts in Zoho's `.com` data centre; other data centres use other MX hosts [5]. Microsoft's MX value comes from your admin center [1].

**On another DNS host,** the same fields may have other names (Host, Alias, Points to, Answer). Some hosts want the name field blank instead of `@`, and some add your domain to whatever you type. Enter `_dmarc`, not `_dmarc.example.com`, and check the saved record. Google and Zoho both warn about this [2][11].

## How do I set up Google Workspace email on my domain?

**1. Verify the domain.** In the Admin console go to **Menu** → **Account** → **Domains** → **Manage domains** and click **Verify domain**. Copy the whole TXT value, including `google-site-verification=`. Add it as a TXT record on `@`, and leave it in place until Google confirms; that can take up to 72 hours [7].

**2. Create the users** who need mailboxes before you move mail to Google.

**3. Add the MX record and activate Gmail.** Add MX `@` → `smtp.google.com`, priority `1`, and remove every other MX record. Then, in **Manage domains**, click **Activate Gmail** for the domain and follow the steps. New MX records can take up to 72 hours to be recognised [4]. Domains set up before 2023 may use older values starting with `aspmx`. Google still supports them, so a working setup doesn't need changing [4].

**4. Add SPF.** TXT `@` → `v=spf1 include:_spf.google.com ~all`. If another service already sends as your domain, add the include to that record instead of creating a second one [12]:

```text
v=spf1 include:_spf.google.com include:<your other sender's value> ~all
```

**5. Generate the DKIM key.** Go to **Menu** → **Apps** → **Google Workspace** → **Gmail** → **Authenticate email**, pick the domain and click **Generate New Record**. Choose 2048 bits if your DNS host supports it, otherwise 1024, and keep the prefix `google`; use another prefix only if the domain already has a `google` key. A new Gmail setup needs 24 to 72 hours before it can generate a key at all [8].

**6. Publish the DKIM record.** TXT `google._domainkey` → the `v=DKIM1; k=rsa; p=…` value from that page. Some DNS hosts limit TXT length; Google's page links help for that case [8].

**7. Start authentication.** Wait: DKIM can take up to 48 hours to work after you add the key. Then return to **Authenticate email** and click **Start authentication**. The status should read "Authenticating email with DKIM" [8].

**8. Add DMARC** 48 hours later, as described [in the DMARC section](#how-should-i-roll-out-dmarc).

```text
@                  TXT  google-site-verification=…          # step 1
@                  MX   1 smtp.google.com                   # step 3
@                  TXT  v=spf1 include:_spf.google.com ~all # step 4
google._domainkey  TXT  v=DKIM1; k=rsa; p=…                 # step 6
```

## How do I connect my domain to Microsoft 365 email?

**1. Add the domain.** In the Microsoft 365 admin center go to **Settings** → **Domains** → **Add domain**, enter it and choose **Use this domain** [9].

**2. Verify it.** Choose **Add a TXT record to the domain's DNS records**, add the TXT value shown in your admin center on `@`, then click **Verify**. Microsoft says this takes up to 10 minutes, or up to 48 hours with some registrars [9].

**3. Add users and mailboxes** for everyone who gets mail at the domain. Do it before you add the MX record so mail keeps flowing [9][1].

**4. Open the record list.** On the domain, choose **DNS records** → **Manage DNS** → **Continue**. Keep **Exchange and Exchange Online Protection** selected, and under **Advanced options** also tick **DomainKeys Identified Mail (DKIM)**. Choose to add the records yourself; Microsoft then shows each value to copy [1].

**5. Add the mail records** with the values shown in your admin center, using TTL 3600 [1]:

```text
@                    MX     0 <value shown in your admin center>
autodiscover         CNAME  <value shown in your admin center>
@                    TXT    v=spf1 include:spf.protection.outlook.com -all
selector1._domainkey CNAME  <value shown in your admin center>
selector2._domainkey CNAME  <value shown in your admin center>
```

Remove the previous provider's MX records, or give them a lower priority (a higher number) than Microsoft's. If an SPF record already exists, don't create a new one: add `include:spf.protection.outlook.com` to it, so one record covers both senders [1].
**6. Let Microsoft check.** Back in the admin center, click **Continue**. Microsoft verifies the records and shows **Domain setup is complete** [1].

**7. Turn on DKIM signing.** In the Microsoft Defender portal open **Email authentication settings** (security.microsoft.com/authentication) → **DKIM**. Open the domain's details: **Publish CNAMEs** lists the two CNAME values. If it's empty, slide the domain's toggle once; Microsoft creates the keys, shows an error message that contains the values, and fills **Publish CNAMEs**. Once those CNAMEs are in DNS, which Microsoft detects within a few minutes or longer, switch on **Sign messages for this domain with DKIM signatures** [6]. The targets look like Microsoft's example `selector1-contoso-com._domainkey.contoso.n-v1.dkim.mail.microsoft`; older ones end in `onmicrosoft.com` [6].

**8. Add DMARC** once SPF and DKIM pass, as described below.

## How do I set up Zoho Mail on my own domain?

**1. Verify the domain.** In the Admin Console go to **Domains**, select the domain, and under **Verify Domain Ownership** choose **Add a TXT record in the DNS**. Add TXT `@` → `zoho-verification=zb….zmverify.zoho.com` (the `zb` code is unique to your domain), then click **Verify TXT record**. Zoho allows an hour or two, and you can delete the record once it passes [13].

**2. Create the users** who need mailboxes.

**3. Add the MX records.** Find the values under **Domains** → your domain → **Email Configuration** → **MX**; the right ending for your data centre is listed under **Tools & Configurations**. For the `.com` data centre [5]:

```text
@  MX  10 mx.zoho.com
@  MX  20 mx2.zoho.com
@  MX  50 mx3.zoho.com
```

Delete every MX record from the previous provider first, then verify the MX in the Admin Console. Zoho says DNS changes can take 12 to 24 hours depending on TTL [5].
**4. Add SPF.** TXT `@` → `v=spf1 include:zohomail.com -all`, or `include:one.zoho.com` if you use more than one Zoho service. Zoho's setup steps also show `~all`, a softer ending. Either way, keep a single SPF record and merge other senders into it, as in Zoho's example `v=spf1 include:abc.com include:def.com include:zohomail.com ~all` [10].

**5. Set up DKIM.** Under **Domains** → your domain → **Email Configuration** → **DKIM**, click **Add**, name a selector and choose a key length. Publish the TXT value at `<selector>._domainkey`, and only then click **Verify** and enable signing [11].

**6. Add DMARC** once SPF and DKIM pass.

## How do I set up Fastmail with my own domain?

**1. Add the domain** in Fastmail under **Settings** → **Domains**. The domain wizard walks you through it; choose the option where your DNS stays where it is [14].

**2. Add the records** at your DNS host [14]:

```text
@               MX     10 in1-smtp.messagingengine.com
@               MX     20 in2-smtp.messagingengine.com
@               TXT    v=spf1 include:spf.messagingengine.com ?all
fm1._domainkey  CNAME  fm1.example.com.dkim.fmhosted.com
fm2._domainkey  CNAME  fm2.example.com.dkim.fmhosted.com
fm3._domainkey  CNAME  fm3.example.com.dkim.fmhosted.com
_dmarc          TXT    v=DMARC1; p=none;
```

Replace `example.com` with your domain in the DKIM targets. The two Fastmail MX records should be the only MX records. To combine Fastmail with other senders, put their includes between `v=spf1` and `?all` in the same record [14].
**3. Check the status** on the **Domains** screen. A green tick means the records are complete and correct [14].

**4. For a subdomain,** add the same MX records on that subdomain. Add SPF on `<subdomain>` and DKIM CNAMEs at `fm1._domainkey.<subdomain>` pointing to `fm1.<subdomain>.<domain>.dkim.fmhosted.com`, and likewise for fm2 and fm3 [14].

## How do I use my own domain with iCloud Mail?

**1. Write down your current addresses** at the domain; Apple asks you to enter them during setup [15].

**2. Start the custom domain setup** in iCloud Mail. Apple shows the records to add.

**3. At your DNS host, delete the existing MX records**, then add [15]:

```text
@                TXT    <value shown on the iCloud Mail setup page>
@                TXT    v=spf1 include:icloud.com ~all
@                MX     10 mx01.mail.icloud.com.
@                MX     10 mx02.mail.icloud.com.
sig1._domainkey  CNAME  sig1.dkim.example.com.at.icloudmailadmin.com.
```

Use your own domain in place of `example.com` in the DKIM target. If you already have an SPF record, add `include:icloud.com` before its `~all`. Apple suggests TTL 3600, and if your DNS host rejects the trailing dots, leave them out [15].
**4. Click Verify** on the iCloud Mail setup page; it can take a few minutes. Check progress at icloud.com/icloudplus under **Custom Email Domain** → **Manage** [15].

**5. Create any new addresses** once the domain is set up [15].

## How should I roll out DMARC?

DMARC is one TXT record on `_dmarc`, the same for every provider. Add it 48 hours after SPF and DKIM are in place, and always include a `rua` address for reports [2]. Google's recommended rollout [16]:

| Stage | Record | Move on when |
| --- | --- | --- |
| 1. Watch | `v=DMARC1; p=none; rua=mailto:dmarc@example.com` | After at least a week of daily reports that show no problems with your outgoing mail |
| 2. Quarantine a share | `v=DMARC1; p=quarantine; pct=5; rua=mailto:dmarc@example.com` | Raise `pct` step by step to 100, reading reports daily |
| 3. Reject (optional) | `v=DMARC1; p=reject; rua=mailto:dmarc@example.com` | Messages that fail are refused and never delivered |

At `quarantine`, failing mail goes to spam. Google suggests starting with about 10% for a small organisation and 1% for a large one [16]. Before you tighten the policy, make sure every service that sends as your domain passes SPF or DKIM, including newsletter tools and billing systems [2]. Reports can be numerous, so send them to a group or a mailbox kept for them [2]. The **DMARC (watch first)** preset on Nymwell adds stage 1 and sends reports to `dmarc@` your domain, or to the address you type in. Create that mailbox or alias so the reports have somewhere to land.

## How long does each step take?

| Step | How long, according to the provider |
| --- | --- |
| Ownership TXT | Google up to 72 hours [7]; Microsoft up to 10 minutes, 48 hours with some registrars [9]; Zoho about an hour or two [13]; iCloud a few minutes [15] |
| MX | Google up to 72 hours [4]; Zoho 12 to 24 hours depending on TTL [5] |
| DKIM | Google up to 48 hours before you click **Start authentication** [8]; Microsoft a few minutes or longer to detect the CNAMEs [6] |
| DMARC | Add it 48 hours after SPF and DKIM, then watch for at least a week [2][16] |

On Nymwell a saved record is published straight away, but resolvers that already looked the name up keep the old answer until its TTL runs out.

## How do I check each record?

Ask public DNS directly. `@8.8.8.8` asks Google Public DNS, which skips your computer's cache:

| Check | macOS / Linux | Windows |
| --- | --- | --- |
| MX | `dig @8.8.8.8 MX example.com +short` | `nslookup -type=mx example.com 8.8.8.8` |
| SPF and verification TXT | `dig @8.8.8.8 TXT example.com +short` | `nslookup -type=txt example.com 8.8.8.8` |
| DKIM as TXT (Google, Zoho) | `dig @8.8.8.8 TXT google._domainkey.example.com +short` | `nslookup -type=txt google._domainkey.example.com 8.8.8.8` |
| DKIM as CNAME (Microsoft, Fastmail, iCloud) | `dig @8.8.8.8 CNAME selector1._domainkey.example.com +short` | `nslookup -type=cname selector1._domainkey.example.com 8.8.8.8` |
| DMARC | `dig @8.8.8.8 TXT _dmarc.example.com +short` | `nslookup -type=txt _dmarc.example.com 8.8.8.8` |

Each answer should match what you entered. You should see exactly one TXT value starting with `v=spf1`, and only your provider's MX hosts.

`npx nymwell info example.com` puts the mail facts on one line: the MX hosts, and whether SPF and DMARC exist. For fastmail.com on 2026-11-01 the line read:

```text
  email       10 in1-smtp.messagingengine.com, 20 in2-smtp.messagingengine.com · SPF yes · DMARC yes
```

The domain's **Email** tab in the Nymwell console shows the same checks, plus DKIM. It looks for DKIM under the selectors the common providers document (including Google, Microsoft 365, Zoho, Fastmail and iCloud Mail) and under any selector among the domain's records in Nymwell. A selector with an unusual name that you added at another DNS host may not show, so check it with the commands above.

The providers' own checkers:

- **Google:** the Admin Toolbox Dig tool (MX) [4] and the Check MX tool [17]; the DKIM status on **Authenticate email** [8].
- **Microsoft:** the admin center checks the records when you click **Continue** [1]. In the Defender portal the DKIM status reads **CnameMissing** until it finds the CNAMEs [6].
- **Zoho:** **Verify** buttons in the Admin Console and the MX lookup in Zoho's Toolkit [5].
- **Fastmail:** the green tick on **Domains** [14]. **iCloud:** **Verify**, then **Custom Email Domain** at icloud.com/icloudplus [15].

### The final test: send and receive

**1. Receive:** from an account at another provider, send a message to your new address and confirm it arrives in the new mailbox, not the old one.

**2. Send:** from your new address, send a message to an account at another provider, for example Gmail. Google's check needs a Gmail or Google Workspace user other than yourself [8].

**3. Read the header.** In Gmail, open the message, click **More** next to **Reply** and choose **Show original** [18]. Find `Authentication-Results`. It should contain results like these, simplified from Microsoft's example [6]:

```text
Authentication-Results: mx.google.com;
  dkim=pass header.i=@example.com header.s=selector1;
  spf=pass (google.com: domain of you@example.com designates … as permitted sender) smtp.mailfrom=you@example.com;
  dmarc=pass header.from=example.com
```

`header.s` is the DKIM selector and `smtp.mailfrom` is the address SPF checked. `dkim=none (message not signed)` means DKIM isn't on yet [6]. Google's Admin Toolbox Messageheader tool can also read a pasted header [18].

## How do I switch from my old email provider without losing mail?

**1. Lower the TTL a day ahead.** Edit the current MX records (and the SPF record) and set TTL to 300. Zoho recommends the lowest TTL your DNS host allows [5]. TTL is how long resolvers may cache a record [19], so the lower value counts only after the old one runs out. A record that had TTL 86400 needs a full day.

**2. Prepare the new provider without touching MX.** Verify the domain (a TXT record doesn't change where mail goes) and create every mailbox and alias from your list [9].

**3. Let both providers send.** Add the new provider's include to your existing SPF record, keeping the old one for now [1]. For example, while moving to Microsoft 365:

```text
v=spf1 include:<old provider's value> include:spf.protection.outlook.com -all
```

**4. Set up DKIM at the new provider.** Each provider signs with its own selector, so the old and new DKIM records can sit side by side. Google asks for a different prefix if the domain already has a `google` key [8].

**5. Switch MX at a quiet time.** Delete the old provider's MX records and add the new ones. Microsoft also accepts leaving the old ones at a lower priority [4][1][15].

**6. Keep the old mailbox open.** New mail goes to the new provider, and what's already stored stays with the old one unless you migrate it [1]. Some senders reach the old servers until their cache expires; Google allows up to 72 hours [4]. Check the old inbox for a few days and move its mail with the new provider's import or migration tools.

**7. Clean up.** When nothing arrives at the old provider and nothing sends from it, remove its include from SPF and delete its DKIM records. Raise TTLs back to 3600; Microsoft recommends at least 3600 on SPF records [3]. Then start DMARC at `p=none`.

## Cases people run into

### I only want forwarding, not a new mailbox

On Nymwell, the domain's **Email** tab has **Email forwarding**. Enter a mailbox name such as `hello` and an inbox you already use to send `hello@yourdomain.com` there. Forwarding only receives: you reply from the other inbox, so anything you send shows that address, not your domain's. Use forwarding or a mailbox provider for a domain, not both. When you move to a mailbox provider, remove the forwards and make sure the only MX records left are the provider's.

If the domain's DNS is on Cloudflare, Cloudflare Email Routing does the same job. It needs Cloudflare DNS, forwards to destination addresses you verify, and adds its own MX, SPF and DKIM records [20].

### Newsletters and app notifications

For mail sent by services you don't run directly, such as a newsletter platform, Microsoft recommends a subdomain like `marketing.example.com` [3]. Problems with that mail then don't hurt the reputation of your staff's mail, and the subdomain gets its own budget of 10 SPF lookups. Each sending subdomain needs its own SPF record, and subdomains inherit the parent domain's DMARC policy unless you set one for them [3]. Gmail's guidelines add: use the same From address for each kind of message, and keep account notifications and promotions apart [21].

### Will mail records break my website?

No. MX, TXT and DKIM records don't touch the A, AAAA or CNAME records that serve the root and `www`; Microsoft notes your website keeps working where it is [9]. To connect the website itself, see [Connect a domain to Vercel, Netlify, Cloudflare Pages or GitHub Pages](https://nymwell.com/en/guides/connect-domain-to-vercel-netlify-cloudflare/).

### DNS on Cloudflare: the proxy must be off for mail

MX and TXT records are always DNS-only on Cloudflare. But a hostname an MX points to must resolve to a DNS-only target, and mail protocols don't pass through Cloudflare's HTTP proxy. CNAME flattening can also stop a provider reading DKIM or autodiscover CNAMEs [22]. Nymwell's DNS has no proxy, so this applies only when Cloudflare hosts the DNS.

### Gmail and Yahoo rules for senders

| Who | Gmail [21] | Yahoo [23] |
| --- | --- | --- |
| Everyone | SPF or DKIM; valid forward and reverse DNS for sending IPs; TLS; spam rate below 0.3% | SPF or DKIM; valid forward and reverse DNS; spam rate below 0.3% |
| Bulk senders | More than 5,000 messages a day to personal Gmail: SPF and DKIM, DMARC at `p=none` or stricter, From domain aligned with SPF or DKIM, one-click unsubscribe for marketing | SPF and DKIM, DMARC at `p=none` or stricter that passes, alignment, one-click unsubscribe honoured within 2 days |

Google Workspace, Microsoft 365, Zoho, Fastmail and iCloud run the sending servers; your part is the DNS records above.

### "SPF: too many DNS lookups"

A receiving server may follow at most 10 DNS lookups while it evaluates your SPF record. Each `include:`, `a`, `mx`, `exists` and `redirect` counts, and so do the includes nested inside them; `ip4:`, `ip6:` and `all` don't. Past 10, SPF fails with `permerror`, and the message can bounce [3]. Fewer than 10 includes doesn't guarantee fewer than 10 lookups. Remove services you no longer use, or move them to a subdomain [3].

### A domain that never sends mail

Tell receivers to reject anything claiming to come from it: TXT `@` `v=spf1 -all` [3] plus a DMARC `p=reject`. The **No email (stop spoofing)** preset on Nymwell adds both.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| Mail to a new address bounces | MX switched before the mailbox existed | Create the user at the new provider [9] |
| Some mail still lands at the old provider | An old MX record remains, or resolvers still cache the old answer | Delete the old MX; wait out the old TTL, up to 72 hours [4] |
| The provider can't find a record you added | Not visible yet, or the name was saved as `_dmarc.example.com.example.com` | Check with `dig`; re-enter only the part before your domain [2] |
| Sent mail lands in spam | SPF or DKIM missing, or DKIM not started | Add SPF; turn on DKIM signing (**Start authentication** at Google, the toggle at Microsoft) [8][6] |
| SPF `permerror` or "too many lookups" | Two SPF records, or more than 10 lookups | Merge into one record; drop or move senders to a subdomain [3] |
| Microsoft DKIM stays at **CnameMissing** | CNAMEs missing, mistyped or not yet visible | Copy them from **Publish CNAMEs** and check with `dig CNAME` [6] |
| Google won't take the DKIM record | The DNS host limits TXT length | Follow Google's long-key help, or use a 1024-bit key [8] |
| A newsletter tool's mail is rejected after DMARC | It isn't in SPF and doesn't sign with your domain's DKIM | Add its include or DKIM, or move it to a subdomain; go back to `p=none` meanwhile [2][3] |
| On Cloudflare, mail or DKIM fails | A mail hostname is proxied, or a CNAME is flattened | Set mail records to DNS only [22] |
| Nymwell's **Email** tab says no DKIM, but `dig` finds it | The selector has a name the tab doesn't know, usually a custom name added at another DNS host | Nothing to fix; trust the `dig` answer and the provider's status |

## Questions

**Will switching MX records move my old email?**
No. New mail goes to the new provider; existing mail stays with the previous one unless you migrate it [1].

**Will setting up email affect my website?**
No. Mail records are separate from the A and CNAME records for the root and `www` [9].

**Can I use two email providers on one domain?**
Only one set of MX records receives mail for a name, so one provider holds the inbox. Other services can still send as your domain if the single SPF record includes them and each signs with its own DKIM selector [1][10]. To receive at a second provider, give it a subdomain.

**Do I need DMARC?**
Gmail and Yahoo require it from bulk senders, at `p=none` or stricter [21][23]. For everyone else it's still worth adding at `p=none`, because the reports show who is sending as your domain.

**Can an AI agent set this up for me?**
Partly. An agent connected over Nymwell's signed-in MCP server (`https://nymwell.com/mcp/account`) can apply the same presets or stage single records, and the workspace's setting decides whether they apply at once or wait for your approval. The steps inside Google's, Microsoft's or Zoho's admin console, such as verifying, creating users and turning on DKIM, still happen there.

## Next step

Create the mailboxes at your provider, then open the domain in the [Nymwell console](https://nymwell.com/app/domains/). Under **DNS**, verify ownership and apply the preset or add the records. Turn on DKIM at the provider, and finish with the send-and-receive test. Add DMARC at `p=none` two days later.

## Sources

Checked on 2026-11-01.

1. Microsoft Learn, connect your domain by adding DNS records: https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider
2. Google Workspace Admin Help, set up DMARC: https://knowledge.workspace.google.com/admin/security/set-up-dmarc
3. Microsoft Learn, set up SPF to identify valid email sources: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure
4. Google Workspace Admin Help, set up MX records for Google Workspace: https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace
5. Zoho Mail Help, configure email delivery (MX records): https://www.zoho.com/mail/help/adminconsole/configure-email-delivery.html
6. Microsoft Learn, how to use DKIM for email in your custom domain: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure
7. Google Workspace Admin Help, verify your domain with a TXT record: https://knowledge.workspace.google.com/admin/domains/verify-your-domain-with-a-txt-record
8. Google Workspace Admin Help, set up DKIM: https://knowledge.workspace.google.com/admin/security/set-up-dkim
9. Microsoft Learn, add a custom domain to Microsoft 365: https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain
10. Zoho Mail Help, SPF configuration: https://www.zoho.com/mail/help/adminconsole/spf-configuration.html
11. Zoho Mail Help, DKIM configuration: https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html
12. Google Workspace Admin Help, set up SPF: https://knowledge.workspace.google.com/admin/security/set-up-spf
13. Zoho Mail Help, domain verification: https://www.zoho.com/mail/help/adminconsole/domain-verification.html
14. Fastmail Help, setting up your domain: MX only: https://www.fastmail.help/hc/en-us/articles/1500000280261-Setting-up-your-domain-MX-only
15. Apple Support, set up an existing domain with iCloud Mail: https://support.apple.com/en-us/102374
16. Google Workspace Admin Help, recommended DMARC rollout: https://knowledge.workspace.google.com/admin/security/recommended-dmarc-rollout
17. Google Admin Toolbox, Check MX: https://toolbox.googleapps.com/apps/checkmx/
18. Gmail Help, trace an email with its full headers: https://support.google.com/mail/answer/29436
19. Cloudflare DNS docs, Time to Live (TTL): https://developers.cloudflare.com/dns/manage-dns-records/reference/ttl/
20. Cloudflare docs, enable Email Routing: https://developers.cloudflare.com/email-routing/get-started/enable-email-routing/
21. Gmail Help, email sender guidelines: https://support.google.com/mail/answer/81126
22. Cloudflare DNS docs, troubleshooting email issues: https://developers.cloudflare.com/dns/troubleshooting/email-issues/
23. Yahoo Sender Hub, sender best practices: https://senders.yahooinc.com/best-practices/

## Related

- [Connect a domain to Vercel, Netlify, Cloudflare Pages or GitHub Pages](https://nymwell.com/en/guides/connect-domain-to-vercel-netlify-cloudflare/)
- [Who owns a domain and when it expires](https://nymwell.com/en/guides/who-owns-a-domain/)
- [How to transfer a domain](https://nymwell.com/en/guides/domain-transfer/)
- [DNS management for domains and AI agents](https://nymwell.com/en/dns/)