DNS and Email Migration: Understanding MX, SPF, DKIM, and DMARC

During an email migration, DNS configuration is often the most technical part. MX, SPF, DKIM, DMARC... These acronyms can seem intimidating. Yet understanding them is essential to ensure your email deliverability and prevent messages from ending up in spam.

Infomaniak Mail Hosting

Overview: How Email Works

When you send an email to contact@example.com, here\'s what happens:

1. Your email server looks up the MX records for example.com
2. It gets the receiving server\'s address
3. It establishes a connection and transmits the email
4. The destination server checks SPF, DKIM, and DMARC before accepting
5. The email arrives (or doesn\'t) in the recipient\'s inbox

Each DNS record plays a specific role in this process.

MX Record: Your Mail Server\'s Address

What Is the MX Record For?

The MX (Mail eXchanger) record indicates which server should receive emails for your domain. Think of it as the postal address for your digital mailbox.

MX Record Format

MX for Infomaniak

To use Infomaniak servers, configure:

Priority and Redundancy

You can define multiple MX records with different priorities. If the primary server is unavailable, the next one takes over:

• MX 10 mail-primary.example.com (tried first)
• MX 20 mail-secondary.example.com (if the first fails)

SPF: Who Is Allowed to Send?

What Is SPF For?

SPF (Sender Policy Framework) lists the servers authorized to send emails for your domain. It\'s a protection against identity spoofing.

When a server receives an email from @example.com, it checks whether the sending server is listed in example.com\'s SPF record. If not, the email is suspicious.

SPF Record Format

SPF for Infomaniak

SPF Mechanisms

• a – Authorizes the IP from the domain\'s A record
• mx – Authorizes the servers listed in the MX record
• ip4:x.x.x.x – Authorizes a specific IP
• include:domain – Includes another domain\'s SPF

End Qualifiers

• -all – Strictly reject (hard fail)
• ~all – Mark as suspicious (soft fail) – recommended
• ?all – Neutral, no verification

DKIM: Digital Signature for Emails

What Is DKIM For?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The recipient can verify that the message wasn\'t modified in transit and genuinely came from the legitimate server.

How It Works

1. Your email server signs each message with a private key
2. The public key is published in DNS
3. The receiving server retrieves the public key
4. It verifies the message signature
5. If the signature is valid, the email is authenticated

DKIM Record Format

DKIM uses a TXT record with a selector:

DKIM for Infomaniak

Infomaniak automatically generates and manages DKIM for you. If you use Infomaniak DNS servers, it\'s configured automatically. Otherwise, retrieve the record from your Infomaniak Manager.

DMARC: The Security Policy

What Is DMARC For?

DMARC (Domain-based Message Authentication, Reporting & Conformance) combines SPF and DKIM to define a policy for handling failed emails. It tells receiving servers what to do if an email fails the checks.

DMARC Record Format

DMARC Policies

• p=none – Monitoring mode (do nothing, just report)
• p=quarantine – Send suspicious emails to spam
• p=reject – Reject suspicious emails

Recommended Starting DMARC

DNS Propagation: The Time Factor

What Is Propagation?

When you modify a DNS record, the change isn\'t instantaneous. It must propagate across DNS servers worldwide. This is propagation.

Propagation Duration

• Theoretical: defined by the record\'s TTL (Time To Live)
• Practical: generally a few minutes to 48 hours
• Average: 1 to 4 hours for most changes

Minimizing Propagation Time

1. Reduce the TTL of your records to 300 (5 minutes) a few days before the migration
2. Make the change
3. Once propagated, restore a normal TTL (3600 or higher)

Complete Configuration for Infomaniak

Here are all the DNS records needed for an optimal Infomaniak email configuration:

Verifying Your Configuration

Online Tools

• MXToolbox – Comprehensive MX, SPF, DKIM, DMARC verification
• Mail-tester.com – Test deliverability by sending an email
• DMARC Analyzer – DMARC report analysis

Command Line Tools

Common Mistakes to Avoid

Conclusion

Email DNS configuration may seem complex, but it\'s essential for:

• Receiving your emails (MX)
• Preventing your emails from being marked as spam (SPF, DKIM)
• Protecting your domain against spoofing (DMARC)

Take the time to properly configure these records. If you\'re not comfortable with it, InfoSwitch can handle this technical part of your migration.

Create My Infomaniak Mail Service