DNS records explained: SPF, DKIM, DMARC, MX and tracking CNAME

Every cold-outreach domain needs four DNS records to land in the inbox: MX, SPF, DKIM, and DMARC. If you use BrandJet tracking, a fifth CNAME record is added. Here is what each one does, and how to set it up.

MX — where mail lands

The MX record tells the world which server receives mail for your domain. Without a valid MX, replies and warmup conversations cannot reach you.

• Google Workspace: priority 1, value smtp.google.com.

• Microsoft 365: priority 0, value yourdomain-com.mail.protection.outlook.com.

• One MX per provider. Remove any old MX records from previous providers.

SPF — who can send as you

SPF is a TXT record listing the servers allowed to send mail on behalf of your domain. Receivers check SPF before they check anything else.

• Google Workspace: v=spf1 include:_spf.google.com ~all

• Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all

• SendGrid or Mailgun add-on: include their domain in the same record, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.

You can only have one SPF record per domain. If you need more includes, merge them into one record.

DKIM — cryptographic signature

DKIM signs each outgoing message with a private key your provider holds. Receivers verify the signature against the public key in your DNS, proving the message was not tampered with and actually came from your provider.

• Google Workspace: generate the key in Apps Google Workspace Gmail Authenticate email, then add the resulting google._domainkey TXT record at your DNS host.

• Microsoft 365: enable DKIM in Microsoft Defender Email and collaboration Policies DKIM. Microsoft will give you two CNAME records (selector1 and selector2) to add at your DNS host.

• Custom or SMTP/IMAP provider: follow your provider DKIM setup. The selector name varies.

DMARC — what to do when a check fails

DMARC tells the receiver what to do when SPF or DKIM fails. It also sends you reports about who is sending mail from your domain.

Start with a monitoring policy and tighten over time:

• Day 1: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

• Once you trust your sending: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

• For very high-volume senders: v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

The record name is always _dmarc.

Tracking CNAME — your branded click domain

If you use click tracking, BrandJet rewrites links to a tracking domain. Using your own branded subdomain (for example links.yourdomain.com) instead of track.brandjet.ai improves trust and click-through rate.

• Add a CNAME record at links.yourdomain.com pointing to track.brandjet.ai.

• In BrandJet, go to Settings → Domains, add the subdomain, and click Verify.

• Once verified, all tracked links rewrite to your branded domain automatically.

Verifying everything is right

Use the Domain health check inside Settings → Domains, or external tools like MXToolbox or mail-tester.com. Send a test from BrandJet to a personal Gmail; look at the original message and confirm SPF, DKIM, and DMARC all show PASS.