Guides › Providers

SPF, DKIM and DMARC for Fastmail

SPF

Host: @
Type: TXT
Value: v=spf1 include:spf.messagingengine.com ?all

Fastmail's own docs use ?all. Many admins tighten this to ~all once DKIM and DMARC are in place.

If you already have an SPF record, add the include to it rather than creating a second record. Two SPF records make SPF fail (see merging SPF records).

DKIM

Publish three CNAMEs that Fastmail rotates for you:

fm1._domainkey  CNAME  fm1.yourdomain.com.dkim.fmhosted.com
fm2._domainkey  CNAME  fm2.yourdomain.com.dkim.fmhosted.com
fm3._domainkey  CNAME  fm3.yourdomain.com.dkim.fmhosted.com

DMARC

DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.

Use the checker to confirm all three records. It detects Fastmail's DKIM selector automatically if it's a standard one.

Related