DNS plays a critical role in sending and receiving email: it provides the infrastructure mail servers rely on to talk to each other. Yet proper DNS configuration is often neglected—or people assume it happens automatically. Fact is: even if you’re on M365, you must configure these records yourself. If you don’t, your emails will land in spam and you’ll open up security gaps.
On top of that, serious security risks emerge:
- Email spoofing: attackers can send forged messages that appear to come from your domain.
- Phishing: users can be tricked by manipulated emails, exposing sensitive data.
- Spam abuse: your domain can be misused to send spam, damaging your reputation.
Correctly configuring DNS records for email
Every email provider requires the right DNS setup so you can successfully send and receive messages.
1. MX records:
MX (Mail Exchange) records ensure email is delivered correctly. They specify which server receives mail for a given domain. Make sure priorities are set correctly: lower numbers mean higher priority.
Example:
- Name: example.com
- Type: MX
- Priority: 1
- Value: mail.example.com • Additional MX records with lower priority (if needed).
2. TXT record (SPF):
An SPF record helps prevent spam by defining which IPs or hosts may send email for your domain. Create a DNS TXT record starting with “v=spf1”, followed by the authorized IPs or hosts. The qualifier at the end (e.g., “~all”) tells receivers how to handle everything else. Review and update SPF whenever your sending infrastructure changes.
Example:
- Name: example.com
- Type: TXT
- Value: v=spf1 include:mail.example.com ~all
3. TXT record (DKIM):
A DKIM (DomainKeys Identified Mail) TXT record is key to authentication. DKIM adds a digital signature to outbound messages so receiving servers can verify authenticity and integrity. Publish your public key in DNS at a selector like selector._domainkey.example.com. The value contains the public key your recipients use to validate signatures.
Example:
- Name: default._domainkey.example.com
- Type: TXT
- Value: DKIM key provided by your mail server or hosting provider.
4. TXT record (DMARC):
A DMARC (Domain-based Message Authentication, Reporting & Conformance) TXT record defines your policy for handling mail that fails SPF or DKIM. Add a TXT record to specify whether such messages are accepted, quarantined, or rejected—and where to send aggregate reports so you can spot issues and improve security.
Example:
- Name: _dmarc.example.com
- Type: TXT
- Value: v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com
Which DNS records do I need to prevent hackers from sending emails under my brand name?
To stop attackers from sending emails under your brand name, you need three DNS records – all configured as TXT records: SPF, DKIM and DMARC. The decisive one is DMARC with the policy p=reject, because only DMARC instructs receiving mail servers to actually reject forged emails.
SPF defines which servers are allowed to send on behalf of your domain, DKIM adds a tamper-proof signature to your emails – and DMARC enforces both and determines what happens to unauthenticated messages.
Often overlooked: also lock down domains that don’t send any email (e.g. parked domains or pure website domains). These are exactly the ones attackers love to abuse, because they’re left unprotected. Best practice (recommended by security authorities and Mozilla, among others): v=spf1 -all combined with v=DMARC1; p=reject;.
To check whether all your domains are correctly protected, run the free Security Check from CheckFix in just a few minutes.
5. CNAME record (Autodiscover)
A CNAME for Autodiscover helps clients like Outlook configure themselves automatically. It routes setup requests to the right server so users can add accounts with minimal friction. With a correct Autodiscover record, settings such as IMAP and SMTP are detected automatically—saving time and reducing errors. Point your CNAME at the correct Autodiscover host in your DNS management.
Example:
- Name: autodiscover.example.com
- Type: CNAME
- Value: mail.example.com
Tips for email DNS configuration
- Use authentication protocols: implement SPF, DKIM, and DMARC to protect your domain from abuse.
- Test your setup: tools like MXToolbox or DMARC Analyzer help verify records are correct.
- Monitor continuously: review DMARC reports to spot suspicious activity early.
Conclusion
Getting DNS right is essential for secure, reliable email. Think your setup is solid? Run the FREE Status Check from CheckFix to see how your company—or your client—stacks up. Or jump straight to the full Hack Test and get a personalized to-do checklist with step-by-step actions to make life harder for attackers.