MX, SPF, and DKIM setup so mail avoids spam
Inbound mail needs a correct MX record. Outbound trust needs SPF and DKIM (and usually DMARC). Skip any of these and you will see missing mail, spam folder placement, or “via” warnings — even if the product UI looks fine.
MX — where inbound mail goes
MX points your domain at the servers that accept mail for @yourdomain.com. Only one mail system should be authoritative for a domain at a time. After you change MX, allow DNS time to propagate before you expect a clean cutover.
SPF — who may send for your domain
SPF is a TXT record that lists sending services allowed to use your domain. Keep a single SPF policy per domain; merge includes carefully. Too many lookups break SPF.
DKIM — cryptographic signing
DKIM adds a signature so receivers can verify the message was authorized by your domain. You publish a public key as DNS TXT; your mail provider signs outbound mail with the matching private key.
DMARC — policy on failures
DMARC tells receivers what to do when SPF/DKIM alignment fails, and where to send reports. Start with p=none while you monitor, then tighten once authentication is clean.
If Unbox hosts your domain mail
Unbox shows the exact MX, SPF, DKIM, and related values for your domain and checks them as you add records. Use that dashboard as the source of truth instead of copying generic blog snippets.
Common questions
- We set MX but still cannot receive mail
- Confirm the MX host and priority, wait for DNS TTL, and check that no old provider still expects the domain. Also verify you created the mailbox or shared queue for the local part people write to.
- Mail sends but lands in spam
- Check SPF and DKIM for the From domain, align DMARC, and avoid sending from a domain that does not match the visible From.
Related guides
Generate the records for your domain
Add your first domain free and follow the live DNS checks.
Add your first domain free