How to Set Up a Custom Domain on Tuta

Learning how to set up a custom domain on Tuta is mostly a DNS job, not a Tuta job. You add the domain inside your account, Tuta tells you which records to publish, and you publish them at whoever runs your domain's DNS. Tuta then re-checks those records and marks the domain as working.

Three record types carry the whole thing: MX so mail arrives, SPF so your outgoing mail is authorised, and DKIM so it is signed. A fourth, DMARC, is optional but worth adding once the first three are green.

Everything below was checked against Tuta's live DNS and its own published pages in September 2026. Tuta shows the exact values inside the setup panel, so treat the wizard as the authority and this page as the map.

The short answer: which DNS records does Tuta need?#

Tuta uses one MX record, one SPF TXT record and two DKIM CNAME records. The DKIM entries are CNAMEs rather than TXT records on purpose — they delegate the key to Tuta, so Tuta can rotate signing keys later without asking you to edit DNS again.

The values below are the ones Tuta publishes for its own domain, tuta.com, as resolved on 17 September 2026. Copy the values your account shows you rather than these; they are here so you know what a correct set looks like.

Before you start#

Four things need to be true before the wizard will get you anywhere. None of them take long, but discovering a missing one halfway through is what turns a ten-minute task into an afternoon.

• A paid Tuta plan. Custom domains are not available on the free Basic plan — see the plan table below.
• Access to the DNS zone for the domain, which is often your registrar but may be Cloudflare, your host, or a separate DNS provider.
• A note of what currently receives mail for the domain. Changing the MX record moves inbound mail away from whatever has it now.
• The current TTL on your MX and TXT records. Lower it to 300 seconds a few hours before you make changes and the cutover will be far quicker.

How to set up a custom domain on Tuta, step by step#

1. 1

   Open Settings, then Global Settings

   In the Tuta web app or desktop app, open Settings from the left-hand navigation and select Global Settings. Tuta documents this path in its own DKIM article, last updated May 2024.

2. 2

   Go to Custom email domains and add the domain

   Find the Custom email domains section and add the domain you want, typed exactly as it appears in DNS — example.com, not www.example.com and not an email address.

3. 3

   Read the records the wizard generates

   Tuta shows the specific host names and values for your domain. Copy them from here. These are the authoritative values; anything you find in an article, including this one, is a second opinion.

4. 4

   Publish the MX record

   In your DNS zone, set the MX record for the root of the domain to Tuta's mail host at the priority Tuta gives. Remove MX records pointing at a previous provider, or mail will keep going there.

5. 5

   Publish or edit the SPF record

   Add the SPF TXT record at the root of the domain. If an SPF record already exists, merge the Tuta include into it instead of creating a second one.

6. 6

   Publish both DKIM CNAMEs

   Add the two _domainkey CNAMEs. Watch for DNS panels that silently append your domain to the host field — you want s1._domainkey, not s1._domainkey.example.com.example.com.

7. 7

   Let Tuta re-check, then add addresses

   Return to Custom email domains and re-check. Once the records resolve, the domain is usable and you can create addresses on it, or set it as the sender address for your mailbox.

Which Tuta plans allow a custom domain?#

Custom domains are a paid feature. The free Basic plan does not include them, and no amount of DNS configuration will change that. Plan details on tuta.com/pricing as of September 2026:

How long does Tuta domain verification take?#

There is no queue on Tuta's side. Verification is a DNS lookup, so the wait is your own DNS propagating — governed by the TTL that was on the record before you changed it, not by how long the new record has existed.

If the old TTL was 300 seconds, expect minutes. If it was 86,400 seconds, some resolvers will serve the old answer for the better part of a day. That gap is why the check can pass for Tuta while your own laptop still sees the old record.

Check what the internet sees rather than what your DNS panel says it saved: dig +short example.com MX and dig +short s1._domainkey.example.com CNAME.

What to do when it doesn't work#

One caveat on DMARC specifically: the standard was updated in 2026. RFC 9989 obsoletes RFC 7489, removes the pct tag, and replaces the Public Suffix List with a bounded DNS tree walk. Plenty of guidance still online tells you to use pct — it no longer exists. DMARC.org and the RFC itself are the places to check.

Catch-all, aliases and multiple users#

Once the domain verifies, Tuta lets you enable a catch-all, so mail sent to an address that does not exist on your domain still reaches you. That is useful for typos and per-service addresses, and it is also how you receive every spam guess a bulk sender throws at your domain. Turn it on deliberately.

For more than one person on the domain, Tuta describes a family option on personal plans, letting relatives use your custom domain with their own mailboxes. Genuine multi-user setups — separate logins, separate billing — are the business plans, priced per user.

What changes for encrypted external recipients#

Mail between Tuta accounts is end-to-end encrypted whichever domain you use. Sending to someone outside Tuta, you choose between a normal message and a password-protected one, where the recipient gets a notification with a link and opens the message after entering an agreed password.

Putting your address on your own domain changes the name on that notification, not the mechanism. The recipient sees [email protected] rather than a Tuta-hosted address, and a password-protected link from a domain they recognise is far likelier to be opened. They still have to receive the password out of band — no DNS record fixes that part.

A faster way, and where it does not apply#

If you wanted a custom domain for encryption, Tuta is a reasonable place to put it and the steps above are the whole job. If you wanted it because your work is scattered across several domains and mailboxes, the domain is half the problem — you still open each account separately and triage each one by hand.

That is the part we work on. AI Emaily pulls Gmail, Outlook and IMAP accounts into one inbox, sorts what arrives, and drafts replies you approve before anything sends, with undo and an audit trail on every action. We build AI Emaily, so treat that as our pitch, not a neutral verdict.

The honest limit: we cannot connect to a Tuta mailbox. Tuta has no IMAP or SMTP access by design, and there is no way around that from our side. If your domain lives on Tuta, this is not your tool. If it lives on a provider that speaks IMAP, see what the agent does with it.