Add SMTPedia as a preferred source on Google
DNS records
MX for routing, TXT for authentication, PTR for identity: the full DNS surface that decides whether email lands or bounces. Every record explained with syntax, testing, and 2026 receiver enforcement.
DNS is where email authentication actually lives. Every SPF check, every DKIM signature validation, every DMARC verdict, and every reputation lookup starts with a DNS query. When your records are wrong, incomplete, or inconsistent, receivers stop trusting you and delivery suffers regardless of how good your content is.
This hub covers the six DNS records that matter for email: MX for inbound routing, TXT for authentication policies (SPF, DKIM, DMARC), A and AAAA for hostname resolution, PTR for reverse DNS identity, and CNAME for tracking and branded domains. Each guide walks through the exact syntax, real production examples, testing tools, and the 2026 receiver requirements that Gmail and Yahoo now enforce.
Every article is grounded in the specific RFC that defines the record type, cross-linked to the authentication pillars where relevant, and updated when receiver policies change. If you are building or auditing an email DNS zone, this hub is the reference.
MX records
Inbound mail routing, priorities, TTL, backup MX design, and how to test with dig.
Read guides →SPF records
Authorized sender list, include mechanics, the 10-lookup DNS limit, and syntax cheatsheet.
Read guides →DKIM records
Cryptographic signing, selectors, key rotation, and what breaks when relays strip signatures.
Read guides →DMARC records
Policy binding SPF and DKIM, alignment, p=quarantine to p=reject progression, aggregate reports.
Read guides →PTR / reverse DNS
Forward-confirmed reverse DNS for outbound IPs. Gmail and Yahoo now enforce; ISPs still fail this.
Read guides →TXT, A/AAAA, CNAME
Supporting records: TXT for policies and tokens, A/AAAA for mail hosts, CNAME for tracking domains.
Read guides →For sending: an SPF record (TXT at your domain root), DKIM keys (TXT at your signing selector hostname), a DMARC policy (TXT at _dmarc.yourdomain.com), and PTR records (reverse DNS on your outbound IPs). For receiving: MX records pointing at your inbound mail servers, plus matching A/AAAA records for the MX hostnames. Modern setups add MTA-STS and TLS-RPT for TLS enforcement, and BIMI for logo display in supporting clients.
SPF authorizes which servers are allowed to send mail as your domain based on IP address. DKIM adds a cryptographic signature to each message that receivers can verify against a public key in DNS. SPF answers "was this sent from an authorized IP?" while DKIM answers "was this message actually authored by the domain?" DMARC binds them together and instructs receivers how to handle failures.
Once you update a record, changes propagate based on the TTL (Time To Live) you set. Common TTLs range from 5 minutes to 24 hours. Global propagation typically completes within TTL + a few minutes, but old cached values can linger at some resolvers for the full TTL duration. For changes that need to take effect quickly, lower TTL 24 hours before the change, apply the change, then raise TTL back after.
The ESP handles it. On shared IP pools (SendGrid, Mailgun, Amazon SES), the PTR points at the ESP hostname and cannot be changed by you. On dedicated IPs, you request PTR from the IP owner (usually your hosting provider or ESP), providing a hostname you control that resolves back to that same IP. Missing PTR is one of the fastest ways to get throttled by Gmail and Yahoo.
FCrDNS stands for Forward-Confirmed Reverse DNS: the PTR record points to a hostname, and that hostname resolves forward via A/AAAA back to the same IP. This closes the identity loop and prevents PTR spoofing. Gmail and Yahoo strictly enforce FCrDNS since the 2024 bulk sender rules; missing or misconfigured FCrDNS produces 550 5.7.25 rejections that no other fix will resolve.
Use dig on the command line for raw record inspection: dig TXT example.com (for SPF), dig TXT _dmarc.example.com (for DMARC), dig MX example.com (for MX), dig -x YOUR_IP (for PTR). For a full validation with parsing and warnings, tools like MXToolbox, DMARC Analyzer, and check-auth@verifier.port25.com run the same tests and highlight configuration errors. Test from multiple public resolvers (8.8.8.8, 1.1.1.1) to confirm propagation.