Email: DNS records for external DNS
A mail domain needs a set of DNS records: they tell the internet which server receives the mail, which servers may send it, how to check its signature and how to reach it securely.
- DNS managed by PlusPanel: when the domain’s zone is hosted on PlusPanel’s DNS and an administrator added the mail domain, every record below is written and kept up to date automatically. There is nothing to do.
- External DNS (your registrar, Cloudflare, another provider): add the records yourself. The panel lists them for each domain under Email → the domain → DNS records, with copy buttons, and checks every record against the public DNS.
1. Prove that the domain is yours
Section titled “1. Prove that the domain is yours”A domain that is neither in a PlusPanel zone of your organization nor the name of one of your sites first asks for a proof of ownership. The panel shows one TXT record:
| Name | Type | Value |
|---|---|---|
_pluspanel-verify.example.com |
TXT | pp-verify= followed by 32 hex characters |
Publish it, then press Verify now (the panel also checks by itself every 5 minutes). Mail is set up as soon as the record is found; until then no mailbox can be created. The record can be removed afterwards.
2. The mail records
Section titled “2. The mail records”The values below are examples for example.com on a server with the address 203.0.113.10. Always copy the
exact values from the panel: they contain your server’s addresses and your own keys.
| Name | Type | Example value | Purpose |
|---|---|---|---|
example.com |
MX | 10 mail.example.com. |
Where mail for the domain is delivered |
mail.example.com |
A / AAAA | 203.0.113.10 |
The server’s address (also for webmail) |
autoconfig.example.com |
A / AAAA | 203.0.113.10 |
Automatic setup of mail apps |
mta-sts.example.com |
A / AAAA | 203.0.113.10 |
Publishes the MTA-STS policy |
example.com |
TXT | v=spf1 mx include:<relay SPF domain> -all |
SPF: which servers may send mail for the domain |
pp202610._domainkey.example.com |
TXT | v=DKIM1; k=rsa; p=MIIBIjANBgkq… |
DKIM: the public key that checks the signature of your mail |
_dmarc.example.com |
TXT | v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r |
DMARC: what receivers do with mail that fails SPF and DKIM |
_mta-sts.example.com |
TXT | v=STSv1; id=20261019T120000 |
MTA-STS: announces the policy and its version |
_smtp._tls.example.com |
TXT | v=TLSRPTv1; rua=mailto:tls-reports@example.com |
TLS-RPT: where servers send TLS failure reports |
_autodiscover._tcp.example.com |
SRV | 0 1 443 autoconfig.example.com. |
Outlook autodiscover |
_imaps._tcp.example.com |
SRV | 0 1 993 mail.example.com. |
Mail app discovery: IMAP over TLS |
_submissions._tcp.example.com |
SRV | 0 1 465 mail.example.com. |
Mail app discovery: sending over TLS |
_submission._tcp.example.com |
SRV | 0 1 587 mail.example.com. |
Mail app discovery: sending with STARTTLS |
Notes:
- SPF depends on how the server sends mail: through the platform relay (the
include:shown in the panel), through your own relay, directly (v=spf1 mx -all) or not at all (v=spf1 -all). A domain may have only one SPF record: if you already have one (for another mail service), merge them into a single record. - DKIM values are long. Many DNS providers split them into strings of 255 characters; that is correct and needs nothing from you.
- Your provider may show names relative to the zone (
mail,_dmarc) instead of full names (mail.example.com); both mean the same.
3. Verification
Section titled “3. Verification”For external DNS the panel resolves every record through public DNS resolvers and shows, per record, Found, Missing or Different (with the value it found). Checks run every hour, and on request with Check the records now (at most every few minutes). DNS changes can take a while to become visible, depending on the records’ TTL.
If one of your own records stands in the way on a PlusPanel-managed zone (for example an existing SPF or DMARC record), PlusPanel never overwrites it: the domain reports a conflict and names the record.
4. DKIM key rotation every 6 months
Section titled “4. DKIM key rotation every 6 months”Each domain signs its outgoing mail with a DKIM key. PlusPanel replaces the key every 6 months (or when you press Rotate the key now), without interrupting mail:
- A new key appears under a new selector, named after the month (for example
pp202704._domainkey). - The new key starts signing only after its record is visible in public DNS. With external DNS, add the new record when the panel shows it; until you do, the current key keeps signing and nothing breaks.
- Seven days later the old key is retired and its record can be removed.
On a PlusPanel-managed zone all three steps happen by themselves.
5. DMARC: quarantine by default
Section titled “5. DMARC: quarantine by default”New domains publish p=quarantine: receivers put mail that fails both SPF and DKIM in the spam folder. You can
choose none (reports only) while you move another mail service, or reject once every sender of the domain
is set up. Change it in Email → the domain → Domain settings. Aggregate reports go to
dmarc-reports@ the domain.
6. MTA-STS: testing by default
Section titled “6. MTA-STS: testing by default”MTA-STS asks other mail servers to deliver to your domain only over verified TLS. New domains start in
testing mode: failures are reported (through TLS-RPT) but mail is still delivered. Once the reports show no
problems, switch to enforce in the domain settings. The policy itself is served at
https://mta-sts.example.com/.well-known/mta-sts.txt; the id in the _mta-sts record changes whenever the
policy changes, so update that record too when the panel shows a new value.