Fastmail Custom Domain: SPF, DKIM and DMARC Setup Guide
The short answer
On a Fastmail custom domain, publish one SPF TXT record (v=spf1 include:spf.messagingengine.com ?all), three DKIM CNAME records (fm1, fm2 and fm3 _domainkey pointing to Fastmail's dkim.fmhosted.com hosts), and one DMARC TXT record at _dmarc starting v=DMARC1; p=none. Fastmail manages the DKIM keys behind those CNAMEs.
Fastmail custom domain SPF DKIM DMARC setup: the exact SPF include, the three DKIM CNAMEs Fastmail delegates, and the DMARC record you still publish yourself.
On this page
Setting up SPF, DKIM and DMARC for a Fastmail custom domain is mostly a copy-and-paste job, with one twist that trips people up: Fastmail hands you DKIM as three CNAME records, not a public key you paste into a TXT record. That is deliberate. Fastmail holds the signing keys for you and rotates them behind those CNAMEs, so you publish a pointer once and never touch the key itself again.
The three records do different jobs. SPF lists which servers may send mail as your domain. DKIM adds a cryptographic signature a receiver can verify against a published key. DMARC tells receiving servers what to do when SPF or DKIM fails, and where to send reports. On Fastmail, SPF and DMARC are TXT records you own, DKIM is delegated to Fastmail by CNAME, and DMARC is the one record Fastmail generally leaves for you to decide.
The short answer#
Add these records wherever your domain's DNS is hosted. SPF is one TXT record on the root domain with the value v=spf1 include:spf.messagingengine.com ?all. DKIM is three CNAME records named fm1._domainkey, fm2._domainkey and fm3._domainkey, each pointing to fmN.yourdomain.com.dkim.fmhosted.com. DMARC is a TXT record named _dmarc whose value starts v=DMARC1; p=none;.
You also need Fastmail's two MX records — in1-smtp.messagingengine.com at priority 10 and in2-smtp.messagingengine.com at priority 20 — so mail reaches Fastmail at all. Copy every value exactly; a single wrong character in a hostname breaks the lookup silently. Fastmail's own domain screen then re-checks these and shows a tick per record once each resolves.
Before you start#
Two things decide how much of this you do by hand. First, who controls your domain's DNS. If you delegated your domain's nameservers to Fastmail, it publishes and maintains MX, SPF and DKIM for you automatically, and you mostly just confirm DMARC. If your DNS lives with a registrar or a host such as Cloudflare and you only point the MX at Fastmail, you add every record yourself.
Second, whether anything other than Fastmail sends mail as your domain — a newsletter tool, a CRM, your own server. If so, its sending needs to be reflected in your one SPF record. Gather what you need before you open the DNS editor.
- Access to the DNS host that actually serves your domain — and confirmation that the domain's live nameservers point there, or nothing you add takes effect.
- Your domain already added and verified inside Fastmail, so its domain screen can re-check the records afterwards.
- The Fastmail values above, copied exactly: the SPF include, the three fmN._domainkey CNAME targets, and the two MX hosts.
- A list of any other service that sends as your domain, plus that service's own SPF include, so you can merge it into a single SPF record rather than publishing a second one.
Set up the records, step by step#
Work through these in order and save each record before starting the next. Keep the Fastmail values open in another tab to paste from.
- 1
Confirm who hosts your DNS
If your nameservers are delegated to Fastmail, MX, SPF and DKIM are already published and rotated for you — skip to the DMARC step and just confirm the rest. If your DNS lives elsewhere and only your MX points at Fastmail, continue and add each record by hand at that host.
- 2
Point the MX records at Fastmail
Add two MX records on the root of the domain: in1-smtp.messagingengine.com at priority 10, and in2-smtp.messagingengine.com at priority 20. Remove any leftover MX records from a previous provider first, or inbound mail can split between two systems.
- 3
Publish the SPF record
Add one TXT record on the root (host @) with the value v=spf1 include:spf.messagingengine.com ?all. Publish only one v=spf1 record for the domain. If another service also sends as your domain, merge its include: into this same record rather than creating a second SPF record.
- 4
Add the three DKIM CNAMEs
Add three CNAME records: name fm1._domainkey with target fm1.yourdomain.com.dkim.fmhosted.com, and the same pattern for fm2 and fm3. All three are required. Do not convert them to TXT and do not paste a key — Fastmail holds the key and answers the lookup at the far end of the CNAME.
- 5
Publish your DMARC policy
Add a TXT record named exactly _dmarc with a value such as v=DMARC1; p=none; rua=mailto:[email protected]. Starting at p=none collects reports without affecting delivery, so you can confirm your mail passes before tightening to p=quarantine or p=reject.
- 6
Verify
Open your domain in Fastmail's settings and let it re-run its DNS check; each record shows a tick when it resolves. Then send yourself a message from an outside account and check the headers for dkim=pass, spf=pass and dmarc=pass. Allow for caching — receivers keep the old answer until the record's TTL expires.
The DMARC standard changed in 2026 — no pct tag
Fastmail-hosted DNS vs DNS you manage elsewhere#
| Record | If Fastmail hosts your DNS | If you manage DNS elsewhere |
|---|---|---|
| MX | Published for you | Add in1-smtp (10) and in2-smtp (20) by hand |
| SPF | Published for you | Add v=spf1 include:spf.messagingengine.com ?all yourself |
| DKIM | Created and rotated automatically | Add the three fm1/fm2/fm3 CNAMEs by hand |
| DMARC | Confirm it exists; set the policy you want | Add the _dmarc TXT record yourself |
| DKIM key rotation | Handled by Fastmail | Still handled by Fastmail — the CNAMEs delegate to it |
Why Fastmail delegates DKIM with a CNAME#
A pasted DKIM key ties you to one key forever — rotate it and you have to edit DNS again. Fastmail avoids that. Each fmN._domainkey CNAME points at a host Fastmail controls (fmN.yourdomain.com.dkim.fmhosted.com), and the real public key lives there. When Fastmail rotates a key, it changes the record at its end of the CNAME; your DNS never changes. That is why there are three selectors — Fastmail can retire one and sign with another without a gap.
A receiver verifying a message reads the DKIM signature's d= tag (your domain) and s= tag (the selector, for example fm2), as defined in RFC 6376, and looks up fm2._domainkey.yourdomain.com. Your CNAME forwards that query to Fastmail's host, which returns the current public key. The chain is invisible to the receiver — it just finds a valid key at the expected name.
All three DKIM CNAMEs are required
What to do when it doesn't work#
Most Fastmail authentication failures come from a short list of causes, and each has a clean fix. Query the record with a public DNS lookup, compare what returns to what you pasted, and the mismatch usually points straight at the cause.
| Symptom | Likely cause | Fix |
|---|---|---|
| Fastmail's domain screen shows DKIM as not set up | One or more of the fm1/fm2/fm3 CNAMEs is missing or was added as the wrong record type | Add all three as CNAME records; confirm each target ends in .dkim.fmhosted.com and the name is fmN._domainkey. |
| DKIM header shows dkim=fail or no signature | A CNAME was entered with the domain appended twice, resolving to fm1._domainkey.yourdomain.com.yourdomain.com | Most DNS hosts append the domain for you — enter the name as fm1._domainkey, not the full hostname. |
| SPF returns permerror or 'too many DNS lookups' | Two separate v=spf1 records exist, or the record needs more than 10 DNS lookups | Keep exactly one v=spf1 record, merge every include into it, and stay within the 10-lookup limit set by RFC 7208. |
| Mail from another service is flagged as spoofed | That service isn't in your SPF, and Fastmail's ?all is neutral, so it neither passes nor hard-fails | Add the other service's include to the same SPF record; if it also signs with DKIM, that alignment can satisfy DMARC on its own. |
| A DMARC lookup at _dmarc returns nothing | The name was typed with the full domain appended, or no DMARC record was ever published | Publish a TXT named exactly _dmarc with v=DMARC1; p=none; — the host adds your domain for you. |
| Records look correct but receivers still fail them | The change hasn't propagated, or the domain isn't using the nameservers you edited | Confirm the domain's live nameservers match the DNS host you changed, then recheck after the previous TTL expires. |
A faster way — where AI Emaily fits, and where it doesn't#
These records live in DNS, and publishing them is your DNS host's job, not a mail client's. AI Emaily is not a DNS host, a DMARC monitoring service, or a deliverability tester. It will not create these records for you, and for reading DMARC aggregate reports you want a dedicated DMARC platform. If that is the task in front of you, use those.
The adjacent thing we do is on the receiving side. SPF, DKIM and DMARC are how a receiving server decides whether a message truly came from the domain it claims — and AI Emaily reads those same authentication results on the mail arriving in your Fastmail inbox, connected over IMAP, so its spam and phishing checks can flag a sender that failed alignment. It keeps approve-before-send, undo and a full audit trail. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans.
Frequently asked
See it in AI Emaily
Keep reading
Sources
Written by
Nafiul HasanNafiul Hasan is an entrepreneur and AI automation system builder with 10+ years of experience turning messy, manual workflows into reliable automated systems. He designs and ships AI enterprise solutions end-to-end — the agent logic, the data plumbing, and the product people actually use — and founded AI Emaily to give busy professionals their attention back. He writes here from the builder's seat: what works, what breaks, and how to put AI to work without giving up control.