Enabling Advanced Settings
Once you've completed the basic DNS setup, a few advanced records can further improve your email deliverability and protect your domains from being impersonated.
Why go further than the basics?
Basic DNS setup authenticates the domain you actively send from. Advanced settings do two more things: they lock down domains you own but don't use for email (so no one else can spoof them), and they register you directly with Google and Yahoo's postmaster tools, giving you visibility into how your emails are performing with those providers specifically.
1. Secure domains you own but don't send emails from
An unprotected domain (or subdomain) can be used by anyone to send spam or phishing emails. Adding the four records below locks down any domain that doesn't send emails (or no longer does), so third parties can't use it, maliciously or otherwise.
If your domain needs to receive email but should never send any, skip the MX row below and only add SPF, DKIM, and DMARC.
Record | Root domain (Host / Value) | Subdomains, via wildcard (Host / Value) |
MX - blocks sending & receiving | leave blank / Priority |
|
SPF - blocks any server from sending as this domain | leave blank / |
|
DKIM - blocks signature validation |
|
|
DMARC - rejects anything failing SPF/DKIM |
| inherited automatically |
All four records are TXT records except MX. A few things to know:
If a subdomain already has its own MX, SPF, or DKIM record, the wildcard won't override it - remove the existing one first.
SPF only works as a TXT record; the old dedicated SPF record type has been obsolete since 2014.
DMARC is inherited, so you only need to set it once on the root domain.
2. Generate Google and Yahoo verification records
Google and Yahoo each offer a free tool that gives you deliverability data specific to their platform (spam rates, delivery errors, reputation). To use them, you verify domain ownership with a unique TXT record they generate for you.
Google Postmaster Tools
Go to postmaster.google.com and log in with the Google account that will manage the tool.
Click the "+" (Add) button in the bottom right.
Enter the domain name you send emails from, then click Next.
Google generates a unique TXT record like
google-site-verification=xxxxxxxx.Copy this code and add it as a new TXT record in your domain's DNS settings, on the root domain (the Host/Name field should be
@).Return to Postmaster Tools and click Verify. Propagation can be immediate or take up to 48 hours depending on your DNS host.
Yahoo Sender Hub
Go to senders.yahooinc.com and log in with a Yahoo account.
In the Domains section, click "Add a domain" (or "Add DKIM Domain").
Enter the domain configured in your DKIM settings (the
d=value from your DKIM signature).Yahoo generates a unique code like
yahoo-verification-key=xxxxxxxx.Add this code as a TXT record on the root domain (
@) of your DNS zone.Click Verify in Sender Hub. Detection usually takes about an hour once the record has propagated, though it can take up to 24-48 hours.