Set up email for your domain

By the end of this tutorial [email protected] will be a real mailbox: sending, receiving, signed with DKIM, and set up in a mail app on your phone. Eight steps, start to finish, with every click named.

Swap example.com for your own domain as you go.

Email hosting is offered on request

Email is enabled per account. Contact us and we'll switch it on for yours before you start.

What you need first

• The domain, already registered.
• Access to wherever its DNS is managed - your registrar, Cloudflare, Route 53, whoever answers for the name. You will be adding records there, and nobody else can do that part for you.
• At least $3 of credit on the account. Both turning email on and creating a mailbox are refused below that. Top up on Billing.
• Email hosting enabled on your account, per the note above.

1. Add the domain and verify it

Already have the domain on your account with a Verified ownership record? Skip to step 2.

1. Open Domains in the console, or click Domains in the side panel.
2. Click New, at the top right of the domains table. You land on the Create Domain page.
3. Type example.com into Domain Name. That is the whole form.
4. Click Create Domain.
5. You come back to the domains table. Click the domain's name to open it. You land on its Overview tab.
6. Click the DNS tab. Find the row named microapps-verify, marked with an Ownership chip.
7. At your DNS provider, create a TXT record. Name (your provider may call it Host or Record name) is microapps-verify; Value (or Content, or Data) is what the Content column holds. Use the copy icon rather than retyping, it is a long token.
8. Give it a few minutes, then click Verify ownership on that row.

The row's Status goes from Pending to Verified and the domain is locked to your account. The full story, including what happens if someone else claimed your domain first, is in Custom domains & SSL.

2. Turn email on for the domain

1. Still on the domain's page, click the Overview tab.
2. Find the Email card. It reads "Email isn't set up for this domain". Click Set up email.
3. A Set up email dialog opens. Choose your server from Email server. There is normally one option, the server we assigned to your account.
4. Click Enable email.

The card switches to the server's name, and the badge under the domain name goes from Email not set up to Email active.

We generate six DNS records at that moment: MX, SPF, DKIM, DMARC and two SRV records. They are waiting on the DNS tab, which is the next step.

The Email tab has the same button

If you land on the domain's Email tab first, its empty state carries the same Set up email button. Either route opens the same dialog.

3. Publish the mail records at your DNS provider

Nothing sends or receives until these records exist in your zone. This is the part nobody can do for you.

On the domain's DNS tab the six email records sit alongside the ownership, SSL and web records the domain already had. They are not labelled "the MX one" and "the DKIM one" in the Type column, because several of them share a type. The chip beside the record's name is how you tell the rows apart:

Chip	Name	Type column	Needed
Mail	@	MX	Required. Where mail is delivered.
SPF	@	TXT	Required. Authorises our servers to send for you.
DKIM	a long name ending ._domainkey	TXT	Required. Signs your outbound mail.
DMARC	_dmarc	TXT	Optional. Policy and reporting.
IMAP	_imaps._tcp	SRV	Optional. Lets mail apps discover the IMAP port.
SMTP	_submission._tcp	SRV	Optional. Same, for the SMTP port.

The three optional rows carry an Optional chip of their own in the console, so you can spot them at a glance. Publish them anyway while you are already in the DNS panel.

Then, at your DNS provider, for each row:

1. Create a record of the type shown in the Type column.
2. Set Name (Host, Record name) to the value in the Name column. @ means the domain itself, and most providers accept @ for that.
3. Set Value (Content, Data) to the value in the Content column. Click the copy icon next to it rather than retyping. DKIM is a very long key and one wrong character means it never verifies.
4. Set TTL to the value shown, or leave your provider's default. Either is fine.
5. Save.

DKIM, SPF and DMARC are all TXT records

The chip beside the name tells you what a record is for. The Type column tells you what to create, and for DKIM, SPF and DMARC that is a plain TXT record. Don't go hunting for a "DKIM" type in your provider's dropdown, there isn't one.

MX and SRV values are packed into a single string the way a zone file does it, and plenty of providers ask for the parts in separate fields instead. Setting up email breaks each one down field by field.

4. Recheck the records

Give DNS a few minutes to propagate, then go back to the domain's DNS tab and click Recheck DNS, at the top right.

Each row's Status goes from Pending to Verified. Once Mail, SPF and DKIM read Verified, the domain is ready for mailboxes. Publish the optional three as well and the warning banner above the table turns green: "All DNS records verified."

If a record stays Pending, double-check the value against the Content column. TXT records in particular have quoting and length quirks, and some providers silently wrap or truncate long values.

5. Create a mailbox

1. Open Emails in the console, or click Emails in the side panel. You land on the Email Accounts tab.
2. Click New, at the top right. You land on the Create Email Account page.
3. Domain - pick example.com. Choose it first, because it fills in Server for you.
4. Username - the part before the @, so hello, not [email protected]. The hint under the field shows the full address you are about to create.
5. Password - 8 or more characters with an uppercase letter, a lowercase letter, and a digit. Anything less is rejected.
6. Storage - N GB - drag the slider anywhere from 1 to 50 GB. The label above it updates as you drag.
7. Server - already filled in and greyed out. Nothing to do here.
8. Click Create Email Account.

You come back to the Email Accounts table with [email protected] in it, its Status reading ACTIVE. It sends and receives from that moment.

Want this mailbox to collect everything sent to addresses that don't exist, or to copy incoming mail somewhere else? Click the address to open it and use Catch-all and Forwarding under Routing on its Overview tab. Both are covered in Setting up email.

6. Connect a mail client

Any standard mail app works. The username is always the full email address, and the password is the one you just set.

Your server's host names live on the domain page:

1. Open Domains, click the domain's name, then click the Email tab.
2. Expand Client setup. Six tiles: IMAP Server, IMAP Port, SMTP Server, SMTP Port, Username and Password. The two host names have a copy icon.
3. Below the tiles, pick iOS, Android or Desktop for numbered steps written against your own server's values.

Protocol	Host	Port	Security
IMAP (receiving)	your email server's hostname	993	SSL/TLS
SMTP (sending)	your email server's hostname	587	STARTTLS

7. Test it both ways

Inbound first, because it fails loudest:

1. From another account entirely (your personal Gmail is ideal), send a message to [email protected].
2. It should appear in your mail client within seconds. The Received counter on the mailbox's Activity tab ticks up too.

Then outbound:

1. Reply from [email protected] through the client you just set up.
2. Check it arrives, and check it landed in the inbox rather than the spam folder. Watch Sent climb on the same tab.

If inbound mail never arrives, the Mail row on the DNS tab is the first thing to look at. If outbound mail bounces or gets filed as spam, it's SPF and DKIM.

8. Watch the numbers

Open Emails and click the address in the Email column. On the mailbox page:

• The Overview tab shows storage used, the message count, and when the mailbox last received and last sent.
• The Activity tab shows Sent, Received and Bounced over whatever date range you pick, with a daily chart underneath.

The same three numbers roll up beyond one mailbox: click a domain in the Domain column for that domain's mailboxes and totals, or open the Analytics tab on the Emails page for your whole account.

A climbing Bounced count is the number to care about. Email deliverability explains what to do about it.

Rotating DKIM keys

Need fresh keys? On the domain's DNS tab, click Regenerate Records, at the top right, and confirm with Wipe & Regenerate. It wipes the domain's DNS records and builds a fresh set, including a new DKIM key and a new ownership token.

MX, SPF, DMARC and the SRV records normally keep the same values and re-verify on their own. The three you have to go and update at your provider are the Ownership TXT, the DKIM TXT, and the _acme-challenge CNAME.

One extra record to update

Regenerating also rotates the SSL validation label, so the _acme-challenge CNAME changes. Update that record at your DNS provider too, or your next certificate renewal will fail. The certificate you already have keeps serving until it expires, then quietly stops.

Where to go next

• Setting up email - the reference version of everything above, plus catch-all, forwarding, suspending a mailbox, unsubscribes, and turning email off again.
• Email deliverability - the authentication plumbing is handled for you, but what you send and who you send it to is what decides the inbox.
• Emails API - the same flow, scripted.