Before you can send from your own domain, three DNS records need to exist. They prove to Gmail, Outlook and everyone else that we are allowed to send on your behalf — without them your mail lands in spam, or is rejected outright.
This is usually wherever you bought your domain, or whoever hosts your website. If you are not sure, ask whoever set up your website — or look for a login at one of these:
| Provider | Where to go |
|---|---|
| GoDaddy | My Products → Domain → DNS → Manage Zones |
| Cloudflare | Select your domain → DNS → Records |
| Namecheap | Domain List → Manage → Advanced DNS |
| Google Domains / Squarespace | My Domains → DNS → Custom records |
| AWS Route 53 | Hosted zones → your domain → Create record |
| cPanel hosting | Zone Editor → Manage |
Your DNS is not always at the company you bought the domain from. If you have ever “pointed your nameservers” somewhere — at Cloudflare, or a web host — then that is where these records go. Adding them in the wrong place does nothing at all.
DKIM is a cryptographic signature on every message. It is the record that matters most: it is what actually proves the mail is yours. We generated a key for you — the exact value is shown in your dashboard under Manage Senders.
| Type | CNAME |
| Name | om1._domainkey |
| Value | om1.yourdomain.com.dkim.openmailers.com |
| TTL | Automatic, or 3600 |
A CNAME points at a record we host, so when the key is rotated — which is good practice every year or two — it happens on our side and you never touch your DNS again. If your DNS provider cannot create a CNAME at that name, your dashboard also shows a direct TXT version you can paste instead. Either works.
Most providers add your domain automatically. Enter om1._domainkey and it becomes
om1._domainkey.yourdomain.com. If you type the full name you will end up with
om1._domainkey.yourdomain.com.yourdomain.com, which will not work. Cloudflare and
Route 53 show you the final name — check it before saving.
SPF lists who may send using your domain. You need exactly one SPF record — two is worse than none, because receivers treat it as an error and ignore both.
| Type | TXT |
| Name | @ |
| Value | v=spf1 include:spf.openmailers.com ~all |
Look for an existing TXT record starting v=spf1. Edit it — do
not add a second. Insert include:spf.openmailers.com before the ~all or
-all at the end:
before — you also send through Google Workspace v=spf1 include:_spf.google.com ~all after v=spf1 include:_spf.google.com include:spf.openmailers.com ~all
SPF allows at most ten include: lookups. If you use several services —
Google, a helpdesk, a CRM, us — you can quietly exceed it, at which point SPF fails for
everything. If your record already has four or more includes, email it to
support@openmailers.com and we will check it for you.
DMARC tells receivers what to do when a message claiming to be from you fails the other two checks, and asks them to send you reports. Gmail and Yahoo have required it from bulk senders since February 2024.
| Type | TXT |
| Name | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
p=none means “watch and report, reject nothing”. Start here for at
least 30 days and read the reports. They will show you every service sending as
your domain — usually including one or two you had forgotten.
Only once every legitimate source passes should you move to p=quarantine and later
p=reject. Jumping straight to p=reject is the single most common way to
make your own invoices and password resets vanish.
Go back to Manage Senders in your dashboard and press Verify. If it passes, you can send. If not, DNS is often simply still propagating.
To check the records yourself, use any online DNS lookup tool, or a terminal:
dig +short TXT om1._domainkey.yourdomain.com dig +short TXT yourdomain.com dig +short TXT _dmarc.yourdomain.com
| What you see | Usually means | Fix |
|---|---|---|
| DKIM not found | Wrong name, or added at the wrong provider | Check the final record name is om1._domainkey.yourdomain.com — not
doubled. Confirm you edited DNS wherever your nameservers point. |
| DKIM found but does not match | Value truncated on paste | The key is long. Some panels silently cut it. Delete and re-paste, checking the end matches. |
| Multiple SPF records | A second record was added instead of editing the first | Merge them into one v=spf1 line and delete the extra. |
| SPF too many lookups | More than ten include: entries |
Remove services you no longer use, or ask support to flatten it. |
| Verified, but mail still goes to spam | Authentication is necessary, not sufficient | Reputation is built by sending wanted mail consistently. See below. |
Authentication gets you to the inbox door. What keeps you inside it is who you send to and how often. The things that matter most, roughly in order:
Some of your recipients’ addresses will not exist. We record those permanently and will not attempt them again, on any campaign — that protects your reputation and everyone else’s. You do not need to clean them out of your list by hand; we simply skip them.
Still stuck? Email your domain name to support@openmailers.com and we will look at your DNS with you.