Mail Server DNS Records

Complete reference for DNS records required to operate a mail server, including SPF, DKIM, DMARC, MTA-STS, ARC, and autodiscovery configuration.

Table of Contents#

1. Overview
2. Required Records
3. SPF (Sender Policy Framework)
4. DKIM (DomainKeys Identified Mail)
5. DMARC (Domain-based Message Authentication)
6. MTA-STS (Mail Transfer Agent Strict Transport Security)
7. ARC (Authenticated Received Chain)
8. DANE / TLSA for SMTP
9. Autodiscovery Records
10. Complete DNS Example
11. Troubleshooting
12. See Also
13. Sources

1. Overview#

Running a public mail server requires correct DNS configuration for both sending and receiving email. Some records are mandatory for basic functionality, while others build sender reputation and protect against spoofing.

2. Required Records#

A Record#

The A record resolves your mail server's hostname to its public IPv4 address.

If your mail server supports IPv6, also add an AAAA record:

MX Record#

The MX record tells other mail servers where to deliver email for your domain.

• Lower priority numbers are preferred
• Same priority values enable load balancing between multiple servers
• Higher priority values serve as backup (fallback) servers

example.com.    IN    MX    10    mail.example.com.
example.com.    IN    MX    20    backup-mail.example.com.

PTR (Reverse DNS) Record#

The PTR record maps your mail server's IP address back to its hostname. Almost all receiving mail servers perform a rDNS check and may reject or flag mail without a valid PTR.

Note: PTR records are not configured in your DNS zone. They are set by your hosting provider or ISP who owns the IP address block. Contact them to set up rDNS.

The PTR should resolve to a hostname that in turn resolves back to the same IP (forward-confirmed reverse DNS, or FCrDNS):

; Forward: mail.example.com -> 203.0.113.20
mail.example.com.    IN    A    203.0.113.20

; Reverse: 203.0.113.20 -> mail.example.com
20.113.0.203.in-addr.arpa.    IN    PTR    mail.example.com.

3. SPF (Sender Policy Framework)#

SPF (RFC 7208) is a TXT record that declares which IP addresses and servers are authorized to send email for your domain. Receiving servers check SPF to detect forged sender addresses.

Basic SPF Record#

SPF Mechanisms#

SPF Qualifiers#

SPF CIDR Examples#

; Allow a single IP
v=spf1 ip4:203.0.113.20 -all

; Allow an entire /24 subnet
v=spf1 ip4:203.0.113.0/24 -all

; Allow a /32 (single host, explicit)
v=spf1 ip4:203.0.113.20/32 -all

; Allow IPv6 range
v=spf1 ip6:2001:db8:abcd::/48 -all

; Multiple sources: own server + Google Workspace + Mailchimp
v=spf1 ip4:203.0.113.20 include:_spf.google.com include:servers.mcsv.net -all

SPF Limitations#

• Maximum 10 DNS lookups (mechanisms like include, a, mx, exists each count as one lookup; ip4/ip6 do not)
• Exceeding the lookup limit causes a permerror and SPF fails
• Use tools like mxtoolbox.com/spf to validate lookup count

4. DKIM (DomainKeys Identified Mail)#

DKIM (RFC 6376) adds a cryptographic signature to outgoing emails. The receiving server retrieves the public key from DNS and verifies the signature matches the message content.

How DKIM Works#

1. The sending server signs the email headers and body with a private key
2. The signature is added as a DKIM-Signature header
3. The receiving server extracts the d= (domain) and s= (selector) from the header
4. The receiving server queries <selector>._domainkey.<domain> for the public key
5. The receiving server verifies the signature

Generate DKIM Keys#

Using opendkim-genkey:

# Install opendkim tools
sudo apt install opendkim-tools    # Debian/Ubuntu
sudo dnf install opendkim          # RHEL/Fedora

# Generate a 2048-bit RSA key pair with selector "default"
opendkim-genkey -s default -d example.com -b 2048

# Output files:
# default.private  - Private key (install on mail server)
# default.txt      - DNS TXT record to publish

Using OpenSSL directly:

# Generate private key
openssl genrsa -out dkim-private.key 2048

# Extract public key in DNS format
openssl rsa -in dkim-private.key -pubout -outform PEM \
  | grep -v "^-" | tr -d '\n'
# Use this base64 string as the p= value

DKIM DNS Record#

Full example:

default._domainkey.example.com.    IN    TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2K4P...truncated...IDAQAB"

Note: If the public key is longer than 255 characters (common with 2048-bit RSA), the TXT record must be split into multiple strings: "v=DKIM1; k=rsa; p=MIIBIjAN..." "...remainder...". Most DNS providers handle this automatically.

DKIM Key Rotation#

Rotate DKIM keys periodically (every 6-12 months recommended):

1. Generate a new key pair with a new selector (e.g., 202603)
2. Publish the new public key in DNS
3. Configure the mail server to sign with the new key
4. Keep the old DNS record for 7+ days (so in-transit messages can still be verified)
5. Remove the old DNS record

Verify DKIM#

# Check the published DKIM record
dig +short TXT default._domainkey.example.com

# Send a test email to a DKIM verification service
# check-auth@verifier.port25.com or use mail-tester.com

5. DMARC (Domain-based Message Authentication)#

DMARC (RFC 7489) builds on SPF and DKIM to provide a policy for handling authentication failures and a reporting mechanism.

DMARC DNS Record#

DMARC Tags#

DMARC Alignment Modes#

Alignment determines how strictly the domain in the From: header must match the domains used in SPF and DKIM.

Relaxed alignment (r, default):

• SPF: The MAIL FROM (envelope sender) domain and the From: header domain share the same organizational domain (e.g., bounce.example.com aligns with example.com)
• DKIM: The d= signing domain and the From: header domain share the same organizational domain

Strict alignment (s):

• SPF: The MAIL FROM domain must exactly match the From: header domain
• DKIM: The d= signing domain must exactly match the From: header domain

Recommended DMARC Deployment Path#

1. Monitor: Start with p=none to collect reports without affecting delivery:

   v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1

2. Quarantine: After reviewing reports and fixing issues, move to quarantine:

   v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

3. Reject: Once confident, enforce full rejection:

   v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s

Verify DMARC#

dig +short TXT _dmarc.example.com

6. MTA-STS (Mail Transfer Agent Strict Transport Security)#

MTA-STS (RFC 8461) allows a domain to declare that it supports TLS for inbound SMTP, and that sending servers should refuse to deliver mail over unencrypted connections.

How MTA-STS Works#

1. The sending server checks for a _mta-sts.<domain> TXT record
2. If present, it fetches the MTA-STS policy from https://mta-sts.<domain>/.well-known/mta-sts.txt
3. The policy specifies which MX hosts require TLS and the policy mode

DNS Record#

_mta-sts.example.com.    IN    TXT    "v=STSv1; id=20260322"

The id value must change whenever the policy is updated (triggers re-fetch by senders).

HTTPS Policy File#

Host this file at https://mta-sts.example.com/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: mail.example.com
mx: backup.example.com
max_age: 604800

SMTP TLS Reporting (TLSRPT)#

Companion to MTA-STS; receives reports about TLS connection failures:

_smtp._tls.example.com.    IN    TXT    "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

7. ARC (Authenticated Received Chain)#

ARC (RFC 8617) preserves email authentication results across intermediaries (mailing lists, forwarding services) that may break SPF and DKIM.

How ARC Works#

1. An intermediary that modifies or forwards a message records the original authentication results in ARC headers
2. Each intermediary in the chain adds a numbered set of ARC headers (ARC-Authentication-Results, ARC-Message-Signature, ARC-Seal)
3. The final receiving server can evaluate the ARC chain to determine if the message was originally authenticated, even if SPF/DKIM now fail

ARC Headers#

ARC-Authentication-Results: i=1; mx.example.com;
    dkim=pass header.d=sender.com;
    spf=pass smtp.mailfrom=sender.com;
    dmarc=pass header.from=sender.com

ARC-Message-Signature: i=1; a=rsa-sha256; d=example.com; s=arc;
    h=from:to:subject:date:message-id;
    b=<signature>

ARC-Seal: i=1; a=rsa-sha256; d=example.com; s=arc;
    cv=none; b=<seal-signature>

Setting Up ARC#

ARC is configured on the mail server (not in DNS), but requires a DKIM-like key published in DNS:

# Generate ARC signing key
opendkim-genkey -s arc -d example.com -b 2048

Publish the public key:

arc._domainkey.example.com.    IN    TXT    "v=DKIM1; k=rsa; p=<base64-public-key>"

Configure your MTA (Postfix + OpenARC, or similar) to sign with ARC when forwarding.

Note: ARC does not add DNS records beyond a DKIM-style key. Its value is in preserving authentication across forwarding hops. Major providers (Gmail, Microsoft 365) evaluate ARC chains when making DMARC decisions.

8. DANE / TLSA for SMTP#

DANE (DNS-based Authentication of Named Entities) uses TLSA records to pin TLS certificates for SMTP, providing server authentication without relying on public CAs.

SMTP TLSA Record#

_25._tcp.mail.example.com.    IN    TLSA    3 1 1 <sha256-hash-of-public-key>

Generate the TLSA record:

# From the mail server's certificate
openssl x509 -in /etc/ssl/certs/mail.crt -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256 -binary \
  | xxd -p -c 64

Note: DANE for SMTP requires DNSSEC on the zone. Without DNSSEC, TLSA records cannot be trusted and are ignored by validating resolvers.

9. Autodiscovery Records#

Mail clients (Outlook, Thunderbird, mobile clients) use autodiscovery to automatically configure IMAP/SMTP settings based on the user's email address.

SRV Records (RFC 6186)#

; IMAP over TLS (port 993)
_imaps._tcp.example.com.       IN    SRV    0 1 993 mail.example.com.

; IMAP with STARTTLS (port 143)
_imap._tcp.example.com.        IN    SRV    0 1 143 mail.example.com.

; SMTP submission over TLS (port 465)
_submissions._tcp.example.com. IN    SRV    0 1 465 mail.example.com.

; SMTP submission with STARTTLS (port 587)
_submission._tcp.example.com.  IN    SRV    0 1 587 mail.example.com.

; POP3 over TLS (port 995) - if supported
_pop3s._tcp.example.com.       IN    SRV    0 1 995 mail.example.com.

Thunderbird Autoconfig#

Thunderbird checks https://autoconfig.example.com/mail/config-v1.1.xml:

<?xml version="1.0" encoding="UTF-8"?>
<clientConfig version="1.1">
  <emailProvider id="example.com">
    <domain>example.com</domain>
    <incomingServer type="imap">
      <hostname>mail.example.com</hostname>
      <port>993</port>
      <socketType>SSL</socketType>
      <authentication>password-cleartext</authentication>
      <username>%EMAILADDRESS%</username>
    </incomingServer>
    <outgoingServer type="smtp">
      <hostname>mail.example.com</hostname>
      <port>587</port>
      <socketType>STARTTLS</socketType>
      <authentication>password-cleartext</authentication>
      <username>%EMAILADDRESS%</username>
    </outgoingServer>
  </emailProvider>
</clientConfig>

Outlook Autodiscover#

Outlook uses multiple methods in sequence. The most common for self-hosted servers is an SRV record:

_autodiscover._tcp.example.com.    IN    SRV    0 1 443 autodiscover.example.com.

Then serve an Autodiscover XML response at https://autodiscover.example.com/autodiscover/autodiscover.xml.

10. Complete DNS Example#

A fully configured mail domain with all recommended records:

$ORIGIN example.com.

; Required
@           IN    A       203.0.113.10
mail        IN    A       203.0.113.20
mail        IN    AAAA    2001:db8::20
@           IN    MX      10 mail.example.com.
@           IN    MX      20 backup.example.com.

; SPF
@           IN    TXT     "v=spf1 ip4:203.0.113.20 ip6:2001:db8::20 -all"

; DKIM
default._domainkey    IN    TXT    "v=DKIM1; k=rsa; p=MIIBIjAN..."

; DMARC
_dmarc      IN    TXT     "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s"

; MTA-STS
_mta-sts    IN    TXT     "v=STSv1; id=20260322"

; SMTP TLS Reporting
_smtp._tls  IN    TXT     "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

; DANE (requires DNSSEC)
_25._tcp.mail    IN    TLSA    3 1 1 a1b2c3d4...

; CAA (restrict certificate issuance)
@           IN    CAA     0 issue "letsencrypt.org"

; Autodiscovery
_imaps._tcp         IN    SRV    0 1 993 mail.example.com.
_submission._tcp    IN    SRV    0 1 587 mail.example.com.
_autodiscover._tcp  IN    SRV    0 1 443 autodiscover.example.com.
autoconfig          IN    CNAME  mail.example.com.

Troubleshooting#

See Also#

• DNS Record Types
• BIND9

Sources#

• RFC 7208 - SPF (Sender Policy Framework)
• RFC 6376 - DKIM (DomainKeys Identified Mail)
• RFC 7489 - DMARC
• RFC 8461 - MTA-STS
• RFC 8617 - ARC
• RFC 6698 - DANE / TLSA
• RFC 6186 - SRV Records for Mail
• RFC 8460 - SMTP TLS Reporting